Exam guide for cloud switchers · Associate

AZ-104 for AWS engineers: Microsoft Azure Administrator

AZ-104 is the hands-on Azure administration exam.

It covers identity and governance, storage, compute, networking, monitoring and backup. For an AWS engineer it lines up closely with the CloudOps (SysOps) skill set, but the tooling, portal flows and several networking and storage defaults are different.

Last verified: Oct 27, 2026 against the official AZ-104 study guide · Edit on GitHub · Report an error

Exam at a glance

Exam	AZ-104: Microsoft Azure Administrator
Certification	Microsoft Certified – Azure Administrator Associate (Associate)
Status	current
Skills measured as of	Apr 17, 2026
Passing score	700 or greater (per the study guide)
Closest AWS cert	SOA-C03, SAA-C03

Exam prices vary by country and are set on the exam page, so none are quoted here. Microsoft doesn't publish pass rates.

Who it's for

AWS CloudOps/SysOps administrators and platform engineers taking over Azure subscriptions.
Engineers who will run VMs, storage accounts, VNets and backup in Azure day to day.
Anyone aiming for Azure Solutions Architect Expert or DevOps Engineer Expert. Both list the Azure Administrator Associate certification as a prerequisite option.

Domains and how they map to AWS

Domain (official)	Weight	Compare pages
Manage Azure identities and governance	20–25%	6
Implement and manage storage	15–20%	9
Deploy and manage Azure compute resources	20–25%	9
Implement and manage virtual networking	15–20%	14
Monitor and maintain Azure resources	10–15%	5

1. Manage Azure identities and governance 20–25%

Official skill areas: Manage Microsoft Entra users and groups · Manage access to Azure resources · Manage Azure subscriptions and governance

From AWS: IAM users and groups become Microsoft Entra users and groups, with license assignment and self-service password reset added on top. IAM policies become Azure RBAC role assignments at management group, subscription, resource group or resource scope. Organizations, SCPs, tagging and Budgets become management groups, Azure Policy, tags, and Cost Management budgets and alerts. Resource locks are new.

Compare pages to study (6):

2. Implement and manage storage 15–20%

Official skill areas: Configure access to storage · Configure and manage storage accounts · Configure Azure Files and Azure Blob Storage

From AWS: S3 maps to Blob Storage, and EFS and FSx for Windows map to Azure Files, but both live inside a storage account that also sets networking, encryption and redundancy. Presigned URLs map to shared access signatures (SAS). S3 lifecycle rules, versioning and replication map to blob lifecycle management, blob versioning and object replication. DataSync and the AWS CLI map to AzCopy and Storage Explorer.

Compare pages to study (9):

3. Deploy and manage Azure compute resources 20–25%

Official skill areas: Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files · Create and configure virtual machines · Provision and manage containers in the Azure portal · Create and configure Azure App Service

From AWS: CloudFormation maps to ARM templates and Bicep. You need to read and modify them, not just deploy them. EC2 and Auto Scaling groups map to Virtual Machines and Virtual Machine Scale Sets. ECR, Fargate and App Runner map to Azure Container Registry, Container Instances and Container Apps. Elastic Beanstalk maps to App Service, where deployment slots, App Service plans and custom domain/TLS binding are heavily tested.

Compare pages to study (9):

4. Implement and manage virtual networking 15–20%

Official skill areas: Configure and manage virtual networks in Azure · Configure secure access to virtual networks · Configure name resolution and load balancing

From AWS: VPC maps to Virtual Network. Security groups and NACLs map to network security groups (NSGs) and application security groups. Session Manager/bastion hosts map to Azure Bastion. Gateway and interface endpoints map to service endpoints and private endpoints. Route 53 maps to Azure DNS, and NLB to Azure Load Balancer. Expect troubleshooting questions on effective NSG rules and effective routes.

Compare pages to study (14):

5. Monitor and maintain Azure resources 10–15%

Official skill areas: Monitor resources in Azure · Implement backup and recovery

From AWS: CloudWatch metrics, Logs and alarms map to Azure Monitor metrics, Log Analytics and alert rules with action groups. Queries use KQL, not CloudWatch Logs Insights syntax. VPC Reachability Analyzer and flow logs map to Network Watcher and Connection Monitor. AWS Backup maps to Azure Backup, and Elastic Disaster Recovery maps to Azure Site Recovery.

Compare pages to study (5):

Concepts that trip AWS engineers up

Subnets are regional, not zonal

An AWS subnet lives in one Availability Zone. An Azure subnet spans every zone in the region, and you pick the zone on the VM, disk or zonal resource instead. Designs that use "one subnet per AZ" don't carry over.

NSGs are stateful but have allow and deny rules with priorities

AWS splits this between stateful, allow-only security groups and stateless NACLs. An Azure NSG is stateful, has numbered priority rules that can allow or deny, includes default rules, and can be attached to a subnet, a NIC, or both. When both are attached, traffic has to pass both.

Storage account keys are all-powerful

An account access key grants full access to the whole storage account. Prefer Microsoft Entra authorization and user delegation SAS. A stored access policy lets you revoke a service SAS without rotating the keys.

Two kinds of backup vault

Azure Backup uses Recovery Services vaults for some workloads (for example VMs and SQL in VMs) and Backup vaults for others (for example blobs, disks and PostgreSQL). The exam expects you to know which vault type a workload needs.

App Service plans are the compute

Apps run on an App Service plan, which is the VM capacity you pay for. Several apps can share one plan, and scaling happens on the plan. Deployment slots (staging, swap) are a plan-tier feature with no direct Elastic Beanstalk equivalent other than swapping environment URLs.

Basic SKUs are gone

Basic Load Balancer and Basic public IP SKUs were retired on Sep 30, 2025. Current questions assume Standard SKUs, which are secure by default (closed to inbound traffic unless an NSG allows it).

Closest AWS certification

AWS Certified CloudOps Engineer – Associate SOA-C03: Same operational scope: deploy, manage, monitor and back up workloads. Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026.
AWS Certified Solutions Architect – Associate SAA-C03: Partial overlap on networking, storage and compute design. Italian version retires after Dec 31, 2026.

FAQ

What does AZ-104 cover, and how is it weighted?

AZ-104 (Microsoft Azure Administrator) has 5 domains: Manage Azure identities and governance (20–25%); Implement and manage storage (15–20%); Deploy and manage Azure compute resources (20–25%); Implement and manage virtual networking (15–20%); Monitor and maintain Azure resources (10–15%). Weights are from the official Microsoft Learn study guide (skills measured as of Apr 17, 2026).

What is the closest AWS certification to AZ-104?

AWS Certified CloudOps Engineer – Associate (SOA-C03): Same operational scope: deploy, manage, monitor and back up workloads. AWS Certified Solutions Architect – Associate (SAA-C03): Partial overlap on networking, storage and compute design.

Is AZ-104 a current exam?

As of Oct 27, 2026, Microsoft Learn lists AZ-104 as current.