AZ-104 Course Notes

Identity questions on AZ-104 usually turn on the boundary where a permission is assigned. Assign Azure RBAC at the smallest useful scope: management group for broad governance, subscription for shared platform teams, resource group for an application team, and individual resource only when a single service needs a different owner. Inheritance flows downward, so a Contributor assignment at the subscription can be broader than intended even when the task only mentions one resource group.

• Giving Contributor at the subscription when the task only needs access to one resource group, which accidentally inherits to every child resource.

• For access questions, identify the exact scope first: management group, subscription, resource group, or resource.

Storage access questions usually ask which credential model avoids unnecessary account keys. Prefer Microsoft Entra authorization and managed identities for applications running in Azure because RBAC can be scoped and audited. Use a user delegation SAS for temporary Blob access tied to Microsoft Entra credentials, a service SAS for limited access to a specific storage service, and an account SAS only when the token must span services or service-level operations.

• Choosing an account SAS when a user delegation SAS would avoid Shared Key and keep temporary Blob access tied to Microsoft Entra credentials.

• Prefer Microsoft Entra authorization and managed identities when the scenario asks to avoid secrets or Shared Key usage.

Compute deployment questions often separate template language from deployment behavior. Bicep is the cleaner authoring language for Azure Resource Manager deployments, while ARM templates are the JSON format Azure Resource Manager executes. Parameters such as location keep deployments reusable, API versions control the resource schema, and contentVersion tracks template versions; none of those settings by itself changes whether existing resources are deleted.

• Using complete deployment mode in a shared resource group and forgetting it can remove resources that are absent from the template.

• Bicep is the authoring language; ARM is the deployment engine and JSON template model underneath.

Networking administration starts with subnet design because later controls attach to subnets. Address ranges must not overlap connected networks, and subnet delegation, service endpoints, private endpoints, route tables, and NSGs all depend on the subnet boundary. Service endpoints and private endpoints are a frequent AZ-104 confusion: a service endpoint keeps traffic on the Azure backbone to the public service endpoint, while a private endpoint gives the service a private IP in the VNet and usually requires private DNS planning.

• Treating service endpoints and private endpoints as the same design even though private endpoints place a private IP in the VNet and require DNS planning.

• Use NSGs for allow/deny filtering and UDRs for changing the next hop.

Monitoring questions often hinge on whether the data is a metric or a log. Metrics are numeric time-series values suited for quick charts and threshold alerts, while logs are records stored in a Log Analytics workspace and queried with KQL. Use Azure Monitor as the umbrella service, then choose the right data source, workspace, query, and alert type for the troubleshooting task.

• Using a metric alert when the requirement needs KQL over records stored in a Log Analytics workspace.

• Use metrics for numeric threshold monitoring and logs plus KQL for record-level investigation.