AZ-104 Course Notes

Identity questions on AZ-104 usually turn on the boundary where a permission is assigned. Assign Azure RBAC at the smallest useful scope: management group for broad governance, subscription for shared platform teams, resource group for an application team, and individual resource only when a single service needs a different owner. Inheritance flows downward, so a Contributor assignment at the subscription can be broader than intended even when the task only mentions one resource group.

Storage access questions usually ask which credential model avoids unnecessary account keys. Prefer Microsoft Entra authorization and managed identities for applications running in Azure because RBAC can be scoped and audited. Use a user delegation SAS for temporary Blob access tied to Microsoft Entra credentials, a service SAS for limited access to a specific storage service, and an account SAS only when the token must span services or service-level operations.

Compute deployment questions often separate template language from deployment behavior. Bicep is the cleaner authoring language for Azure Resource Manager deployments, while ARM templates are the JSON format Azure Resource Manager executes. Parameters such as location keep deployments reusable, API versions control the resource schema, and contentVersion tracks template versions; none of those settings by itself changes whether existing resources are deleted.

Networking administration starts with subnet design because later controls attach to subnets. Address ranges must not overlap connected networks, and subnet delegation, service endpoints, private endpoints, route tables, and NSGs all depend on the subnet boundary. Service endpoints and private endpoints are a frequent AZ-104 confusion: a service endpoint keeps traffic on the Azure backbone to the public service endpoint, while a private endpoint gives the service a private IP in the VNet and usually requires private DNS planning.

Monitoring questions often hinge on whether the data is a metric or a log. Metrics are numeric time-series values suited for quick charts and threshold alerts, while logs are records stored in a Log Analytics workspace and queried with KQL. Use Azure Monitor as the umbrella service, then choose the right data source, workspace, query, and alert type for the troubleshooting task.