The AZ-104 Microsoft Azure Administrator certification is widely recognized as one of the most practically oriented exams in the Microsoft certification portfolio, and that practical orientation is precisely what makes hands-on lab work so indispensable for candidates preparing to pass it. Unlike certifications that reward theoretical knowledge and memorized definitions, the AZ-104 consistently tests whether candidates can actually configure Azure services, troubleshoot real problems, and make administrative decisions in realistic cloud environments. Reading about Azure is simply not enough preparation for an exam designed to assess what you can do rather than what you know abstractly.
Labs bridge the gap between conceptual understanding and operational competency in ways that no video course or textbook can replicate. When you configure a virtual network, assign role-based access permissions, set up a load balancer, or deploy a storage account through actual Azure tooling, the experience creates a kind of muscle memory and contextual understanding that stays with you far more durably than any passive learning approach. Candidates who complete eighty or more practical labs before their exam date approach the test with a confidence and fluency that candidates relying on study materials alone simply cannot match.
Understanding the AZ-104 Exam Domains Before Starting Your Labs
Before diving into lab work, every AZ-104 candidate benefits from understanding how the exam is organized so that lab practice can be aligned deliberately to the areas that matter most. The exam covers five primary domains: managing Azure identities and governance, implementing and managing storage, deploying and managing Azure compute resources, implementing and managing virtual networking, and monitoring and maintaining Azure resources. Each domain carries a different percentage weighting, and understanding those weightings helps candidates prioritize their lab time rather than spreading effort uniformly across all topics.
Virtual networking and compute resources consistently carry the heaviest combined weighting in the AZ-104 exam, making labs in those areas particularly high-return investments of preparation time. Identity and governance, while carrying a somewhat lighter individual weighting, contains concepts that surface across multiple other domains — meaning that weak identity knowledge creates cascading gaps in areas like storage security, compute access management, and monitoring configuration. Planning your lab sequence with domain weightings in mind from the beginning ensures that your hands-on preparation mirrors the actual emphasis of the exam rather than your personal comfort zone.
Setting Up Your Azure Lab Environment the Right Way
Every candidate needs a working Azure environment before lab work can begin, and setting that environment up correctly from the start saves significant time and frustration. Microsoft offers a free Azure account that includes twelve months of popular free services, a ninety-day credit for new subscribers, and a permanent free tier covering a selection of services. For most AZ-104 lab scenarios, the free account provides sufficient resources to complete exercises without incurring meaningful costs if candidates are careful about cleaning up resources after each session.
Beyond the free account, candidates benefit from understanding how to use Azure Cost Management tools to monitor spending, set budget alerts, and identify unexpectedly running resources before they generate charges. Creating a dedicated resource group for each lab session and deleting it entirely upon completion is a discipline that keeps costs controlled and also reinforces good Azure governance habits that the exam directly tests. Some candidates supplement their personal Azure environment with lab platforms like Microsoft Learn sandboxes, A Cloud Guru, or Whizlabs, which provide pre-configured environments for specific exercises without any cost risk to the candidate’s own subscription.
Identity and Governance Labs That Build Critical Administrative Skills
The identity and governance domain covers Microsoft Entra ID user and group management, role-based access control, Azure subscriptions, management groups, and Azure Policy — all foundational administrative capabilities that underpin every other area of Azure administration. Labs in this domain should begin with creating and managing users and groups in Microsoft Entra ID, including bulk user creation using PowerShell or the Azure CLI, because these operations appear regularly in exam scenarios and benefit enormously from direct hands-on experience.
Role-based access control labs deserve particular attention because RBAC is one of the most consistently tested topics across the entire AZ-104 exam. Practical exercises should include creating custom roles, assigning built-in roles at different scopes including management group, subscription, resource group, and individual resource levels, and verifying that access permissions behave as expected after assignment. Azure Policy labs — creating policy definitions, assigning them at different scopes, evaluating compliance results, and applying remediation tasks — round out the governance portion of this domain and give candidates the operational experience that exam scenarios in this area consistently demand.
Storage Account Labs Covering Every Configuration Scenario
Azure Storage is a broad and technically detailed domain that rewards candidates who have configured storage accounts hands-on across multiple scenarios. Labs in this domain should cover creating storage accounts with different redundancy configurations including locally redundant storage, zone-redundant storage, and geo-redundant storage, and understanding through direct experience how those redundancy options affect both cost and availability characteristics. Configuring blob storage access tiers — hot, cool, and archive — and practicing tier transitions gives candidates the contextual understanding needed to answer scenario-based storage questions accurately.
Security configuration labs within the storage domain are equally important and often where candidates lose points on the actual exam. Practical exercises should include configuring shared access signatures with specific permissions and expiration windows, implementing storage account firewall rules and virtual network service endpoints, enabling blob versioning and soft delete for data protection, and setting up Azure Storage lifecycle management policies that automatically transition or delete blobs based on age. Candidates who have configured each of these features through direct Azure portal and CLI experience find storage security questions significantly more intuitive than those who approached the topic purely through reading.
Virtual Machine Deployment and Management Labs in Depth
Azure Virtual Machines represent one of the heaviest content areas in the AZ-104 exam, and the range of VM-related administrative tasks the exam covers demands an equally broad range of hands-on lab exercises. Foundational VM labs should cover deploying virtual machines through the Azure portal, Azure CLI, and Azure PowerShell, because the exam tests familiarity with all three interfaces and candidates who have only used the portal often struggle with CLI and PowerShell-based scenario questions. Deploying VMs from marketplace images, custom images, and specialized disks each represent distinct scenarios that appear in exam questions.
Advanced VM management labs should include configuring VM availability sets and availability zones for high availability, implementing VM scale sets with autoscale rules based on CPU and memory metrics, managing VM extensions for post-deployment configuration, and working with Azure Bastion for secure VM access without exposing public IP addresses. Disk management labs — adding and resizing data disks, converting between disk types, creating snapshots, and implementing disk encryption using Azure Disk Encryption — address another consistently tested area that rewards candidates who have worked through these operations in a real Azure environment rather than simply reading about the options available.
App Service and Container Labs for Modern Compute Workloads
The AZ-104 compute domain extends beyond virtual machines to include Azure App Service, Azure Container Instances, and Azure Kubernetes Service at a foundational administrative level. App Service labs should cover creating web apps and API apps across different pricing tiers, configuring deployment slots for staging and production environments, setting up custom domains and SSL certificates, and implementing App Service autoscaling rules. These scenarios appear regularly in the exam and require candidates to understand not just how to configure each feature but what business problem each feature solves.
Container labs for AZ-104 purposes focus on administrative rather than development tasks. Practical exercises should include deploying container instances through the Azure portal and CLI, configuring container groups with multiple containers sharing a network namespace, and working with Azure Container Registry to store and manage container images. AKS labs at the AZ-104 level cover cluster creation, node pool configuration, and basic workload deployment rather than the deep Kubernetes administration that specialist certifications address. Hands-on experience with these container services gives candidates the familiarity needed to answer administrative scenario questions accurately without requiring deep container development expertise.
Virtual Networking Labs That Cover Every Exam Scenario
Networking is consistently one of the most challenging domains for AZ-104 candidates, and it is also one of the most heavily weighted areas of the exam. A comprehensive networking lab sequence should begin with foundational virtual network creation, subnet design, and network security group configuration before progressing to more complex scenarios involving peering, routing, and hybrid connectivity. Creating virtual networks with multiple subnets, associating network security groups at both subnet and network interface levels, and verifying traffic flow behavior through effective security rule analysis are essential early labs that build the networking intuition the exam demands.
Advanced networking labs should cover virtual network peering between networks in the same region and across regions, configuring user-defined routes to control traffic flow through network virtual appliances, implementing Azure DNS for both public and private zones, and setting up Azure VPN Gateway for site-to-site connectivity scenarios. Load balancing labs — deploying Azure Load Balancer with backend pools, health probes, and load balancing rules, as well as configuring Azure Application Gateway with path-based routing rules — represent another heavily tested networking area that candidates who have configured these services hands-on find far more approachable than those who relied on diagrams and descriptions alone.
Network Security Labs Including Firewall and Private Endpoint Configurations
Network security deserves its own dedicated lab sequence because of how consistently and deeply the AZ-104 exam tests this area. Azure Firewall labs should cover deploying a firewall instance within a hub virtual network, creating application rules and network rules, configuring threat intelligence-based filtering, and verifying that traffic flows correctly through the firewall according to defined rule collections. Understanding the difference between Azure Firewall and network security groups — and when to use each — is a conceptual distinction the exam tests repeatedly and that hands-on experience with both tools makes intuitively clear.
Private endpoint and Private Link labs address one of the more recent but increasingly prominent areas of the AZ-104 networking domain. Practical exercises should include creating private endpoints for Azure Storage accounts and SQL databases, configuring private DNS zones to resolve private endpoint addresses correctly, and verifying that public access to protected resources is appropriately restricted after private endpoint implementation. Web Application Firewall labs — configuring WAF policies in detection and prevention modes, creating custom WAF rules, and associating WAF policies with Application Gateway — complete the network security lab sequence and address scenarios that regularly appear in the exam’s networking section.
Azure Monitor and Log Analytics Labs for the Monitoring Domain
The monitoring and maintenance domain of the AZ-104 exam covers Azure Monitor, Log Analytics, Application Insights, Azure Alerts, and Network Watcher — a suite of observability and diagnostic tools that administrators use daily in production environments. Monitoring labs should begin with creating a Log Analytics workspace, connecting Azure resources to send diagnostic data to the workspace, and writing basic Kusto Query Language queries to extract meaningful information from collected logs. KQL is tested directly on the exam, and candidates who have written real queries against actual log data find these questions far less intimidating than those who encountered KQL only in theoretical descriptions.
Alert configuration labs are particularly important because the exam consistently presents scenarios where candidates must design appropriate alerting strategies for different monitoring requirements. Practical exercises should cover creating metric alerts, log search alerts, and activity log alerts, configuring action groups with email, SMS, and webhook notification options, and understanding alert severity levels and how they influence operational response. Network Watcher labs — using IP flow verify to diagnose connectivity issues, capturing network packets for traffic analysis, and interpreting connection monitor results — address the troubleshooting dimension of the monitoring domain and prepare candidates for diagnostic scenario questions that appear throughout the exam.
Azure Backup and Site Recovery Labs for Business Continuity
Business continuity and disaster recovery represent a meaningful portion of the AZ-104 monitoring and maintenance domain, and hands-on experience with Azure Backup and Azure Site Recovery is essential for answering these questions accurately. Azure Backup labs should cover creating Recovery Services vaults, configuring backup policies for virtual machines and Azure Files shares, performing on-demand backups, and restoring virtual machines and individual files from recovery points. Understanding the difference between instant restore and vault-tiered recovery, and knowing when each approach is appropriate, is a nuance that only becomes clear through direct lab experience.
Azure Site Recovery labs address replication and failover scenarios that the exam tests at an administrative configuration level. Practical exercises should include enabling replication for Azure virtual machines to a secondary region, configuring replication policies, performing test failovers to verify that recovery objectives can be met, and executing planned failovers during simulated maintenance windows. Candidates who have worked through a complete Site Recovery scenario — from initial replication setup through test failover and failback — develop an end-to-end understanding of the service that helps them navigate even the most complex exam scenarios with confidence and accuracy.
PowerShell and Azure CLI Labs for Administrative Automation
The AZ-104 exam consistently includes questions that describe administrative tasks and ask candidates to identify the correct PowerShell cmdlet, CLI command, or command parameter to accomplish them. Candidates who have only used the Azure portal are systematically disadvantaged on these questions because command-line syntax looks unfamiliar and intimidating without hands-on exposure. Building a dedicated lab sequence around PowerShell and CLI administration is one of the highest-return preparation investments available to any AZ-104 candidate.
PowerShell labs should cover connecting to Azure with Connect-AzAccount, creating and managing resources using Az module cmdlets, writing basic scripts that combine multiple administrative operations, and using Get-AzLog and other diagnostic cmdlets for troubleshooting scenarios. CLI labs should cover the az login workflow, common az group, az vm, az network, and az storage commands, and using the –query parameter with JMESPath expressions to filter command output. Candidates who practice these tools regularly across their lab sessions — using them as alternatives to the portal even for tasks they already know how to do through the GUI — build the command-line fluency that exam questions in this area directly reward.
ARM Templates and Bicep Labs for Infrastructure as Code
Infrastructure as code represents an increasingly prominent area of the AZ-104 exam, reflecting how central template-based deployment has become to modern Azure administration. ARM template labs should cover understanding the basic structure of a template including parameters, variables, resources, and outputs sections, deploying templates through the Azure portal template deployment blade and through CLI commands, and modifying existing templates to change resource configurations or add new resources. Exporting templates from existing resources and using them as the basis for new deployments is a particularly practical skill that the exam tests through scenario-based questions.
Bicep labs address Microsoft’s newer infrastructure as code language, which the AZ-104 exam increasingly references alongside traditional ARM templates. Practical exercises should include writing basic Bicep files that deploy common resources like storage accounts and virtual networks, using the Bicep CLI to compile Bicep files to ARM JSON format, and deploying Bicep files through Azure CLI using the az deployment group create command. Candidates who understand both ARM templates and Bicep — and who have deployed resources using both approaches in real lab environments — are well positioned for infrastructure as code questions regardless of which syntax the exam chooses to feature in any given scenario.
Cost Management and Resource Governance Labs
Azure cost management and resource governance represent practical administrative skills that the AZ-104 exam tests with increasing frequency as organizations place greater emphasis on cloud financial discipline. Cost management labs should cover navigating the Azure Cost Management dashboard, analyzing spending by resource group and service type, creating budget alerts that notify administrators when spending approaches defined thresholds, and using the cost analysis tool to identify unexpected or anomalous expenditure patterns. Candidates who have worked with these tools hands-on develop the spatial familiarity that makes cost management exam questions feel straightforward rather than unfamiliar.
Resource tagging and governance labs connect cost management to the broader identity and governance domain by showing how tags enable cost allocation, resource organization, and policy enforcement at scale. Practical exercises should include creating and applying tags to resources and resource groups through the portal, CLI, and PowerShell, writing Azure Policy definitions that enforce tagging requirements, and using tag-based filtering in cost management reports to analyze spending by department, project, or environment. These governance skills appear across multiple AZ-104 exam domains and represent the kind of cross-cutting administrative knowledge that separates candidates with genuine operational experience from those who studied frameworks without practical application.
Troubleshooting Labs That Simulate Real Administrative Challenges
Troubleshooting scenarios represent some of the most demanding questions in the AZ-104 exam because they require candidates to synthesize knowledge from multiple domains and apply systematic diagnostic reasoning rather than simply recalling a configuration step. Building dedicated troubleshooting labs into your preparation — where you deliberately introduce configuration errors and then work through diagnosing and resolving them — develops exactly the diagnostic mindset these questions reward. Starting a VM that fails to boot due to an incorrect network security group rule, or debugging a storage account that cannot be accessed due to a misconfigured firewall, creates learning experiences that are more memorable and more transferable than any correctly completed configuration exercise.
Troubleshooting labs should cover common VM connectivity issues including network security group rule conflicts, missing public IP associations, and DNS resolution failures. Storage troubleshooting scenarios should address access denied errors caused by incorrect RBAC assignments, shared access signature expiration, and firewall rule conflicts. Networking troubleshooting labs should include diagnosing routing problems using effective routes, identifying security rule conflicts using Network Watcher’s IP flow verify tool, and resolving VPN connectivity failures by examining gateway diagnostics logs. Candidates who have worked through these troubleshooting scenarios hands-on approach diagnostic exam questions with a structured, experience-informed methodology that consistently produces correct answers.
Building a Realistic Eight-Week Lab Practice Schedule
Eighty or more labs spread across eight weeks of preparation creates a manageable daily practice rhythm that builds cumulative competency without overwhelming candidates who are studying alongside full-time professional responsibilities. A realistic schedule dedicates the first two weeks to identity, governance, and storage labs, establishing foundational administrative skills before moving into more complex networking and compute scenarios. Weeks three and four focus on virtual networking and network security labs, which represent the most technically demanding domain and benefit from concentrated, uninterrupted practice time.
Weeks five and six cover compute labs including virtual machines, App Service, and containers, while weeks seven and eight circle back to monitoring, backup, cost management, and troubleshooting labs that integrate knowledge across all previously covered domains. Full-length practice exams should be woven throughout the schedule at roughly ten-day intervals, with results used to identify lab areas that need revisiting before the exam date. Completing the final troubleshooting lab sequence in the last week of preparation leaves candidates entering the exam with their most recent hands-on experience focused on the diagnostic reasoning skills that the hardest exam questions demand.
Conclusion
Completing eighty or more practical labs before your AZ-104 exam is not just a preparation strategy — it is the preparation strategy that most reliably produces first-attempt success for candidates who apply it consistently and thoughtfully. The Azure Administrator certification is built around the premise that real administrators need real skills, and the exam reflects that premise through scenario-based questions, troubleshooting challenges, and command-line syntax tasks that simply cannot be answered correctly without genuine hands-on experience. Every lab session you complete closes the gap between knowing what Azure services exist and understanding how to use them with administrative precision.
The breadth of the AZ-104 lab curriculum outlined in this article reflects the breadth of the exam itself — a certification that expects candidates to administer identities and governance structures, configure storage with appropriate security controls, deploy and manage virtual machines and modern compute workloads, design and implement virtual networks with layered security, monitor environments proactively, and maintain business continuity through backup and disaster recovery configurations. No single domain is an island in this exam, and candidates who approach their lab practice with cross-domain awareness develop the integrated administrative thinking that the most challenging exam questions are specifically designed to test.
Beyond the exam, the laboratory skills you build during AZ-104 preparation have immediate and lasting professional value. Azure administrators who have configured these services with their own hands in real environments — rather than simply observed demonstrations or read documentation — bring a qualitatively different capability to their organizations. They troubleshoot faster, configure more accurately, design more securely, and communicate more clearly about Azure capabilities because their knowledge is grounded in direct experience rather than secondhand description. The certification validates that capability to employers, but the capability itself is what makes you genuinely valuable in the role. Invest fully in your lab practice, approach every exercise with curiosity and rigor, and you will emerge from your AZ-104 preparation not just certified but authentically skilled in the discipline of Azure cloud administration.