Microsoft Azure administrators implement, manage and monitor identity, governance, storage, compute, networking and recovery across cloud environments. The AZ-104 examination supplies a current skills reference, with English objectives effective April 17, 2026. But the job is not a set of screenshots. The work requires knowing which change is authorized, what it affects, how to verify the outcome and how to recover when assumptions fail.
Five practical skill groups provide a way to develop evidence of real administration. Use a separate test subscription and the least privilege needed for an exercise. Keep a record of initial state, intended change, permissions, result and resource cleanup, especially when using services that may incur charges.
1. Control identity and role scope
Microsoft Entra identities, Azure RBAC roles and tenant administrative roles govern different layers of access. A person with a Contributor assignment on one resource group does not automatically become a tenant-wide administrator. Administrators must distinguish authentication, cloud resource authorization and application permissions before granting privileges.
In a lab, create a resource group and grant one test user read-only access. Confirm that the identity can inspect a resource but cannot modify it. Then remove the assignment and verify the effect. This exercise makes scope tangible and shows why permanent broad privileges are a poor workaround for a narrow support request.
Consider how group membership, privileged activation and conditional policy can influence access. If a user cannot open an application, inspect sign-in results and actual resource permissions before changing a protection control. Plan monitored emergency access separately from everyday administrative permissions.
2. Diagnose a network path
An administrator needs to understand virtual networks, subnets, route tables, network security groups, DNS and service endpoints. A private IP does not mean every caller should connect, and a network rule allowing traffic does not repair missing routing or an application listener that is unavailable.
Create two test subnets and one expected connection. First record the effective route and DNS result, then deliberately deny a port through a supported security control. Verify the failure before adding the narrowest acceptable rule. After the change, test again and document whether the application—not just the network port—responds.
Azure Network Watcher capabilities can help diagnose reachability and effective configuration in supported deployments. Remember that Azure Traffic Manager makes DNS routing decisions, while Application Gateway, Azure Front Door and Load Balancer have different request-handling behavior. Choose the service according to protocol, availability and application requirements.
3. Operate compute and storage with recovery
Azure virtual machines, App Service and container platforms have different operating responsibilities. Administrators should understand deployment, update processes, scalability and monitoring, as well as what the customer or application team must still manage. A healthy VM can host an unavailable application when its database, identity provider or external service fails.
Storage decisions involve access control, durability, performance, lifecycle and cost. Shared account keys differ from scoped identity-based data roles. Select a suitable authorization pattern and test it with an identity that should be denied as well as one that should be allowed.
A practical recovery exercise can back up a disposable resource, change or delete a harmless test item, and demonstrate how to restore it under approved controls. Measure what was recovered, how long it took, and what other dependencies remain. A successful backup job does not guarantee that the whole business application can be recovered.
4. Deploy and govern resources predictably
Azure Policy, management groups, subscriptions, resource groups and tags support organization-wide governance. Their hierarchy matters: resource groups are not nested inside resource groups. Policy assignments and RBAC scope should be reviewed at the actual supported levels before assuming a rule applies to a resource.
Use Bicep, ARM templates or Azure CLI to deploy a small approved environment from a versioned configuration. Review the proposed change, verify the resources created, and perform a controlled update. A repeatable template is valuable only if it produces the intended secure state and can be reviewed when a requirement changes.
Add ownership and billing controls. Tags, resource budgets and cost alerts can help identify abandoned resources, but do not assume that every practice account is free. Design a cleanup checklist, and keep evidence that billable endpoints or compute instances were actually removed.
5. Investigate through monitoring and evidence
Azure Monitor, Activity Log, resource logs, Log Analytics and service health information answer different operational questions. If an application is slow, a healthy CPU metric does not prove the database query is fast. If a user cannot log in, a network availability test does not prove that identity policy allowed the request.
Build a simple monitoring case: restart a test application, record the expected availability change, observe logs and validate a user-visible transaction. The observation should answer a question and lead to an action. A dashboard without an owner or useful threshold does not complete incident management.
Practice documenting what changed before the symptom began, which users were affected, and what evidence supports competing explanations. A narrow diagnosis may prevent a hasty tenant-wide security change that creates a larger outage.
Try a small service-outage exercise that combines the five skills. A test web application cannot access a private storage resource after a role change. First check the requesting identity and its resource scope, then verify DNS and route behavior. Inspect application logs, storage access results and recent configuration changes before altering any production-like policy.
Write two competing hypotheses and the observation that would distinguish them. If the application receives an authorization denial, increasing the VM size will not help. If DNS resolves incorrectly, assigning Storage Blob Data Contributor is not a network fix. A disciplined administrator makes one justified change and retests under the same conditions.
After resolution, record which access was changed, who approved it, what logging was retained and how to restore the previous state. This makes the incident a repeatable learning artifact and illustrates the administrator’s responsibility for both security and service continuity.
Connect the skills to AZ-104 and real work
The current AZ-104 objectives include identity and governance, storage, compute, virtual networking, and monitoring and maintenance. These skill groups connect naturally: a newly deployed application requires a network path, identity permissions, storage protection, operating telemetry and recoverability.
The Microsoft AZ-104 exam is an appropriate current exam-level reference, while AZ-104 to AZ-305 progression offers context for moving toward architecture responsibilities. Neither credential guarantees employment or an automatic salary improvement.
The strongest evidence of Azure administration is a set of verified, reversible operational decisions. Show that you can select the right permission, trace the network, recover data, deploy repeatably and explain an incident with evidence. Those competencies survive cloud interface changes.