---
title: "AZ-104 Study Guide — Azure Administrator Associate"
description: "An interactive study guide built on 7 memory techniques to help you pass the Microsoft Certified: Azure Administrator Associate (AZ-104) exam."
url: "https://lucidlabs.com.au/insights/az-104"
---

# Master the AZ-104

An interactive study guide built on 7 memory techniques to help you pass the Microsoft Certified: Azure Administrator Associate (AZ-104) exam.

Identities & Governance ~20%Storage ~20%Compute ~20%Networking ~20%Monitor & Maintain ~20%

What it covers

Managing Microsoft Entra ID identities, RBAC, and governance (policy, locks, tags, management groups); implementing storage accounts, redundancy, and access tiers; deploying and managing VMs, scale sets, App Service, and Azure Backup; implementing virtual networking, security, and load balancing; and monitoring and maintaining Azure resources. Microsoft's current AZ-104 skills outline (refreshed 17 April 2026) lists five domains without published percentage weightings — treat them as roughly even, not the specific splits shown here.

Ideal for

IT administrators and helpdesk/support engineers moving into cloud operations, on-premises sysadmins managing an Azure migration, and MSP engineers running day-to-day Azure environments for clients.

Aspire to this if

You manage servers, networks, or IT infrastructure and want to prove you can run day-to-day Azure operations — or this is your stepping stone toward AZ-305 (architecture), AZ-400 (DevOps), or AZ-120 (SAP on Azure), all of which assume AZ-104 knowledge.

Section 1 / Spatial Memory

## The Map

Tap any component to see what you need to know for the exam.

**🪪 Entra ID & Users**

Users · Groups · Guests

**🔑 RBAC & Hierarchy**

Management Groups · Roles

**📋 Governance & Policy**

Azure Policy · Locks · Tags

**🗄️ Storage Accounts**

Redundancy · Performance

**📦 Blob, Files & Tiers**

Access Tiers · File Sync · SAS

**🖥️ VMs & Availability**

Sizing · Disks · Sets/Zones

**📈 Scale Sets & Containers**

VMSS · ACI · AKS Basics

**🌐 App Service & Backup**

Plans · Recovery Services Vault

**🕸️ VNets, Subnets & NSGs**

Segmentation · Security

**🔗 Peering, VPN & DNS**

Hybrid Connectivity

**⚖️ Load Balancers & Gateway**

L4 vs L7 Traffic

**📊 Monitor & Maintain**

Azure Monitor · Advisor · Network Watcher

Section 2 / Narrative Memory

## The Story

Follow the narrative to build a mental model of how everything connects.

🪪

### Identity Foundations

Every Azure journey starts with identity. Microsoft Entra ID is the tenant-wide directory holding users, groups, and guests. Cloud-only accounts, on-premises synced accounts via Entra Connect, and B2B guest invitations all coexist in the same directory, ready to be assigned licences and access.

**Exam Intel**Know the difference between a tenant (the directory) and a subscription (the billing/resource container) — a tenant can have many subscriptions, but a subscription trusts exactly one tenant. Dynamic groups use rule-based membership (e.g. department eq "Sales"); assigned groups are manual. SSPR requires specific authentication methods to be registered first.

🔑

### RBAC & the Management Hierarchy

Azure organises everything into a scope hierarchy: management groups group subscriptions, subscriptions group resource groups, resource groups group resources. Azure RBAC role assignments and Azure Policy both flow down this hierarchy — assign a role at a management group and every subscription beneath it inherits it.

**Exam Intel**Role assignment = security principal + role definition + scope. Built-in roles to know cold: Owner (full access + can assign roles), Contributor (manage everything except access), Reader (view only), User Access Administrator (manage access only). RBAC is additive; deny assignments are rare, reserved for specific control-plane scenarios.

📋

### Governance at Scale

Once identity and access are set, governance keeps the environment compliant. Azure Policy audits or denies non-compliant resources — enforcing allowed regions, required tags, or mandatory encryption. Resource locks protect critical resources from accidental deletion regardless of who has Contributor access. Tags drive cost allocation and automation.

**Exam Intel**Policy effects to know: Deny (block the request), Audit (log but allow), Append/Modify (inject or change properties), DeployIfNotExists (remediate). Initiatives bundle multiple policies for a standard. Locks: CanNotDelete blocks delete, ReadOnly blocks delete and modify — locks override RBAC permissions, even for Owners.

🗄️

### Storage Accounts & Redundancy

Every piece of unstructured or structured cloud data in this exam lives inside a storage account. Redundancy determines how many copies exist and where: locally, across zones, or across a paired region. Choosing wrong means paying for resilience you don’t need, or leaving data exposed to a single point of failure.

**Exam Intel**Redundancy tiers, cheapest to most resilient: LRS (3 copies, one datacentre), ZRS (3 copies, 3 zones), GRS (LRS + async copy to paired region), GZRS (ZRS + async copy to paired region). RA-GRS/RA-GZRS add read access to the secondary region. General-purpose v2 is the default account kind for the exam.

📦

### Blob, Files & Access Tiers

Data doesn’t just sit still — it ages. Blob access tiers let hot, frequently-accessed data cost more per GB while cold, rarely-touched data costs almost nothing to store, at the cost of retrieval time. Azure Files bridges the gap for legacy apps that expect a network file share, with Azure File Sync caching that share on-premises.

**Exam Intel**Hot = frequent access, highest storage cost, lowest access cost. Cool = infrequent (30-day minimum), lower storage cost. Archive = rare/offline, cheapest storage, hours to rehydrate, 180-day minimum. Lifecycle management policies automate tier transitions and deletions by age. SAS tokens (account, service, or user delegation) scope and time-limit access without sharing keys.

🖥️

### Compute Building Blocks

Virtual machines remain the workhorse of Azure IaaS. Sizing families match workload shape — burstable for dev/test, general purpose for most production apps, memory- or compute-optimised for specialised loads. Availability sets and zones decide how resilient that VM, or fleet of VMs, is to hardware failure.

**Exam Intel**Availability sets: fault domains (shared power/network, typically 2-3) and update domains (shared maintenance window, up to 20) — protects within one datacentre. Availability zones: physically separate datacentres within a region, each with independent power/cooling/network — protects against datacentre-level failure with a higher SLA.

📈

### Scaling & Modern Compute

Fixed-size VMs don’t survive a traffic spike. Virtual Machine Scale Sets add and remove identical VM instances automatically based on load. For workloads that don’t need a VM at all, Azure Container Instances spin up containers in seconds, and Azure Kubernetes Service orchestrates containers at scale. App Service abstracts the VM away entirely for web workloads.

**Exam Intel**VMSS autoscale rules trigger on metric thresholds (CPU %, queue length) or a schedule. Uniform mode = identical instances, higher scale limits; Flexible mode = mix of VM sizes, closer to VM behaviour. ACI = fastest container startup, no orchestration; AKS = full orchestration — know the concept, not deep configuration, for AZ-104. Azure Backup protects VMs via Recovery Services vault policies.

🕸️

### The Virtual Network

A virtual network is Azure’s private, software-defined network — the container for everything that talks to everything else. Subnets segment it, and network security groups control exactly what traffic is allowed in and out at each boundary. Nothing crosses a subnet boundary without an NSG rule permitting it, implicitly or explicitly.

**Exam Intel**NSG rules evaluate on 5-tuple: source, source port, destination, destination port, protocol — lowest priority number wins, and there are default rules you cannot delete (allow VNet in/out, allow load balancer, deny all else). Application security groups let you write rules by VM role, not by IP. Every subnet reserves 5 IPs Azure uses internally.

🔗

### Connecting Networks

Real environments span more than one VNet, and often reach back to on-premises datacentres. VNet peering stitches Azure networks together over Microsoft’s backbone. VPN Gateway extends that reach to on-premises over the public internet with encryption. Azure DNS resolves names consistently across all of it.

**Exam Intel**VNet peering is non-transitive — peering A↔B and B↔C does not let A talk to C without its own peering or a hub. Site-to-site VPN needs a Local Network Gateway (on-prem) and VPN Gateway (Azure); point-to-site connects individual clients. ExpressRoute is private and bypasses the internet — know it exists as the premium alternative to VPN. Private DNS zones auto-register VM records within linked VNets.

📊

### Watching Over Azure

The job isn’t done at deployment — Azure Monitor, Log Analytics, and Azure Advisor keep the environment healthy long after go-live. Metrics and logs stream into a central pipeline, alert rules watch for trouble, and Network Watcher gives point-in-time diagnostic tools when something in the network isn’t behaving.

**Exam Intel**Metrics = lightweight, near-real-time numeric time series. Logs = detailed, queried with KQL in a Log Analytics workspace, better for deep investigation. Alert rule = signal + condition + action group. Azure Advisor recommendations span 5 categories: Cost, Reliability, Performance, Security, Operational Excellence. Network Watcher tools: IP flow verify, NSG diagnostics, connection troubleshoot, packet capture, topology.

Section 3 / Acronym Memory

## Mnemonic Wall

Memorable acronyms and phrases to anchor key exam concepts in your memory.

🏛️

MSRR

**M**anagement Groups, **S**ubscriptions, **R**esource Groups, **R**esources

The Azure resource hierarchy from broadest to narrowest scope. RBAC and Azure Policy inherit down this hierarchy.

🗄️

LZGG

**L**RS, **Z**RS, **G**RS, **G**ZRS

Storage redundancy options from cheapest/least resilient to most resilient. LRS = single datacentre, GZRS = zone + geo redundant.

🌡️

HCA

**H**ot, **C**ool, **A**rchive

Blob access tiers by access frequency and cost. Hot = frequent access. Cool = infrequent (30-day min). Archive = rare, hours to rehydrate.

🔑

ORUC

**O**wner, **R**eader, **U**ser Access Admin, **C**ontributor

Four fundamental Azure built-in roles. Owner = full access + can grant access. Contributor = manage resources, no access-granting. Reader = view only.

🛡️

NDF

**N**SG, **D**DoS Protection, **F**irewall

Layered network security. NSG = subnet/NIC-level allow/deny rules. DDoS Protection = volumetric attack mitigation. Azure Firewall = centralised, stateful, FQDN-aware filtering.

🏢

FUZ

**F**ault domains, **U**pdate domains, Availability **Z**ones

Three layers of VM resilience. Fault/update domains = within an availability set (same datacentre). Availability Zones = physically separate datacentres in a region.

Section 4 / Contrast Memory

## Versus Arena

Side-by-side comparisons to sharpen your understanding of similar concepts.

vs

NSGvsAzure Firewall

Click to compare

#### Network Security Layers

| Aspect | NSG | Azure Firewall |
| --- | --- | --- |
| Layer | Subnet/NIC (Layer 3-4) | Centralised, VNet/hub (Layer 3-7) |
| Type | Stateful ACL rules | Managed firewall-as-a-service |
| Filtering | 5-tuple (source/dest IP, port, protocol) | FQDN filtering, threat intelligence, app rules |
| Scope | Per subnet or NIC | Centralised for hub-spoke topologies |
| Logging | NSG flow logs (Network Watcher) | Built-in diagnostic logs + Azure Monitor |
| Best for | Basic segmentation, cost-sensitive | Centralised egress control, compliance |

Click to flip back

vs

Availability ZonesvsAvailability Sets

Click to compare

#### VM High Availability Options

| Aspect | Availability Zones | Availability Sets |
| --- | --- | --- |
| Scope | Separate physical datacentres in a region | Racks within a single datacentre |
| Protects against | Datacentre-level failure | Rack-level failure (power, network switch) |
| Latency | Higher (cross-zone) | Lower (same datacentre) |
| SLA | 99.99% (zonal/zone-redundant) | 99.95% |
| Fault/update domains | N/A — the zone is the boundary | Up to 3 fault domains, 5 update domains |
| Best for | Mission-critical, region-wide resilience | Basic HA within a datacentre |

Click to flip back

vs

Azure FilesvsBlob Storage

Click to compare

#### File Shares vs Unstructured Objects

| Aspect | Azure Files | Blob Storage |
| --- | --- | --- |
| Protocol | SMB / NFS | REST / HTTPS |
| Use case | Shared file systems, lift-and-shift file shares | Unstructured data, backups, static content, data lakes |
| Mount as | Network drive (on-prem or cloud) | Not natively mountable as a drive |
| Sync | Azure File Sync (hybrid cache on-prem) | AzCopy, Blob lifecycle management |
| Tiers | Transaction Optimized, Hot, Cool | Hot, Cool, Cold, Archive |
| Best for | Legacy apps needing a file share | Cloud-native unstructured storage |

Click to flip back

vs

ARM TemplatesvsBicep

Click to compare

#### Infrastructure as Code

| Aspect | ARM Templates | Bicep |
| --- | --- | --- |
| Syntax | JSON (verbose) | Declarative DSL (concise) |
| Authoring | Manual JSON, harder to read | IntelliSense, modules, simpler syntax |
| Compilation | Deployed directly | Transpiles to ARM JSON before deployment |
| Modularity | Nested/linked templates | Native modules |
| State management | None (declarative, idempotent) | None (declarative, idempotent) |
| Recommended | Legacy / existing templates | Microsoft-recommended for new IaC |

Click to flip back

vs

StandardvsPremium Storage

Click to compare

#### Storage Performance Tiers

| Aspect | Standard | Premium Storage |
| --- | --- | --- |
| Media | HDD-backed | SSD-backed |
| Performance | Higher latency, lower IOPS | Low latency, high IOPS/throughput |
| Use case | General purpose, backups, infrequent access | Production VM disks, databases, I/O-intensive workloads |
| Redundancy | LRS, ZRS, GRS, GZRS, RA-GRS | LRS, ZRS only (most premium tiers) |
| Disk types | Standard HDD, Standard SSD | Premium SSD, Premium SSD v2, Ultra Disk |
| Cost | Lower | Higher |

Click to flip back

Section 5 / Grouping Memory

## Cheat Sheet

Organised reference grouped by exam domain — everything you need on one page.

### Manage Azure Identities and Governance

~20%

#### Microsoft Entra ID

-   Users: cloud-only, synced (Entra Connect), or B2B guest invitations
-   Groups: assigned (static) or dynamic (rule-based membership)
-   Licences (Entra ID P1/P2, Microsoft 365) unlock Conditional Access and advanced features
-   Self-service password reset (SSPR) requires registered authentication methods

#### RBAC

-   Role assignment = principal + role definition + scope
-   Built-in roles: Owner, Contributor, Reader, User Access Administrator
-   Custom roles defined with Actions/NotActions/DataActions in JSON
-   RBAC is additive across all applicable assignments — most permissive wins

#### Governance & Policy

-   Azure Policy effects: Deny, Audit, Append/Modify, DeployIfNotExists
-   Initiatives bundle multiple policies into one assignment
-   Resource locks: CanNotDelete, ReadOnly — override RBAC, even for Owners
-   Tags: key-value pairs for cost allocation, automation, and organisation

#### Subscriptions & Cost

-   Management groups organise multiple subscriptions for policy/RBAC inheritance
-   Cost Management + Billing: budgets, cost analysis, exports
-   Azure Advisor cost recommendations flag idle or oversized resources
-   Resource hierarchy: management group → subscription → resource group → resource

### Implement and Manage Storage

~20%

#### Storage Accounts

-   General-purpose v2: default account kind, supports all storage services
-   Performance tiers: Standard (HDD-backed) or Premium (SSD-backed)
-   Redundancy: LRS, ZRS, GRS, GZRS (plus RA- variants for read access to secondary)
-   Account names: globally unique, lowercase, 3-24 characters

#### Blob Storage

-   Access tiers: Hot, Cool, Cold, Archive — cost trades against retrieval latency
-   Archive is offline; rehydration can take hours (priority: Standard or High)
-   Lifecycle management policies auto-tier or delete blobs by age rules
-   Soft delete and versioning protect against accidental overwrite/deletion

#### Azure Files

-   SMB and NFS protocols for shared file systems
-   Azure File Sync caches a share on an on-premises Windows Server
-   Tiers: Transaction Optimized, Hot, Cool
-   Quotas set per file share to control maximum size

#### Security & Access

-   Shared Access Signatures (SAS): account, service, or user delegation — time-limited, scoped
-   Access keys grant full account access — rotate regularly, prefer Entra auth or SAS
-   Storage firewall restricts access by IP/VNet; private endpoints remove public exposure
-   Encryption at rest by default (Microsoft-managed or customer-managed keys)

### Deploy and Manage Azure Compute Resources

~20%

#### Virtual Machines

-   Size families: B (burstable), D (general purpose), E (memory), F (compute)
-   Managed disks: Standard HDD/SSD, Premium SSD, Ultra Disk
-   VM extensions automate post-deployment configuration (Custom Script, Monitor Agent)
-   Boot diagnostics and serial console assist troubleshooting boot failures

#### Availability & Scaling

-   Availability sets: fault domains (power/network) + update domains (patching), single datacentre
-   Availability zones: physically separate datacentres, region-wide resilience, higher SLA
-   VM Scale Sets: autoscale identical instances on metric or schedule triggers
-   Uniform vs Flexible orchestration mode changes scale limits and instance flexibility

#### App Service & Containers

-   App Service plans set the compute tier (Free/Shared/Basic/Standard/Premium)
-   Deployment slots enable staged rollout and swap-with-preview, zero downtime
-   Azure Container Instances (ACI): fastest container startup, no orchestration
-   Azure Kubernetes Service (AKS): managed orchestration for containerised workloads at scale

#### Backup

-   Recovery Services vault stores backup data and policies
-   Backup policies define schedule (frequency) and retention
-   Restore options: full VM restore or file-level recovery
-   Soft delete on backup data protects against accidental or malicious deletion

### Implement and Manage Virtual Networking

~20%

#### VNets & Subnets

-   VNets segment into subnets; every subnet reserves 5 IP addresses for Azure
-   Network security groups (NSGs) filter traffic by 5-tuple, priority-ordered rules
-   Application security groups (ASGs) group VMs by role for use in NSG rules
-   Service endpoints and private endpoints extend VNet identity to PaaS services

#### Connectivity

-   VNet peering: direct, low-latency, non-transitive by default
-   VPN Gateway: site-to-site (on-prem to Azure) or point-to-site (client to Azure)
-   ExpressRoute: private dedicated connection, bypasses the public internet
-   Azure DNS: public zones (internet-facing) and private zones (VNet-internal resolution)

#### Load Balancing

-   Azure Load Balancer: Layer 4 (TCP/UDP), public or internal
-   Application Gateway: Layer 7 (HTTP/S), URL routing, SSL offload, built-in WAF
-   Azure Firewall: centralised, stateful, FQDN filtering, threat intelligence
-   Traffic Manager (DNS) and Front Door (global HTTP/S) route across regions

#### Routing & Diagnostics

-   User-defined routes (UDRs) override system routes to force traffic via firewall/NVA
-   Health probes remove unhealthy backend instances from load balancer rotation
-   DDoS Protection: Basic is automatic; Standard adds tuned mitigation and reporting
-   Network Watcher: topology, IP flow verify, NSG diagnostics, packet capture

### Monitor and Maintain Azure Resources

~20%

#### Azure Monitor

-   Metrics: lightweight, near-real-time numeric time series
-   Logs: detailed records queried with Kusto Query Language (KQL)
-   Diagnostic settings route platform logs/metrics to Log Analytics, Storage, or Event Hubs
-   Application Insights extends monitoring to application-level telemetry

#### Log Analytics

-   Workspaces store log data collected from agents, diagnostic settings, and integrations
-   KQL queries filter, aggregate, and join log data for troubleshooting and reporting
-   Workbooks combine queries, metrics, and text into interactive reports
-   Data retention is configurable per workspace or per table

#### Alerts & Advisor

-   Alert rule = signal (metric/log) + condition + action group
-   Action groups notify via email, SMS, webhook, Logic App, or Automation runbook
-   Azure Advisor: recommendations across Cost, Reliability, Performance, Security, Operational Excellence
-   Dynamic thresholds reduce alert noise on variable metrics

#### Network Watcher & Troubleshooting

-   IP flow verify: checks whether a specific packet is allowed or denied
-   NSG diagnostics: traces which rule is affecting traffic for a flow
-   Connection troubleshoot: tests connectivity between a VM and an endpoint
-   Packet capture: captures traffic to/from a VM for deep analysis

Section 6 / Method of Loci

## The Memory Palace

Walk through themed rooms — each object anchors a concept in spatial memory.

### The Identity & Governance Hall

Manage Identities and Governance — where access begins

🪪

Entra ID

Tenant-wide directory. Users, groups, guests. Cloud-only or synced via Entra Connect

🔑

RBAC Roles

Owner, Contributor, Reader, User Access Administrator. Additive across scopes

🏛️

Management Hierarchy

Management group → subscription → resource group → resource. RBAC and Policy inherit down

📋

Azure Policy

Deny, Audit, Append/Modify, DeployIfNotExists. Initiatives bundle policies

🔒

Locks & Tags

CanNotDelete/ReadOnly locks override RBAC. Tags drive cost allocation

### The Storage Vault

Implement and Manage Storage — where data lives

🗄️

Storage Accounts

GPv2 default. Standard/Premium performance. LRS/ZRS/GRS/GZRS redundancy

🌡️

Access Tiers

Hot, Cool, Cold, Archive. Lifecycle management automates transitions

📁

Azure Files

SMB/NFS shares. Azure File Sync caches on-prem. Transaction Optimized tier

🎫

SAS Tokens

Time-limited, scoped access. Account, service, or user delegation SAS

🔐

Storage Security

Firewall by IP/VNet. Private endpoints. Encryption at rest by default

### The Compute Workshop

Deploy and Manage Compute — where workloads run

🖥️

Virtual Machines

B/D/E/F size families. Managed disks: Standard/Premium/Ultra

🏢

Availability Sets/Zones

Sets = fault/update domains, one datacentre. Zones = separate datacentres

📈

VM Scale Sets

Autoscale identical instances. Uniform vs Flexible orchestration

🌐

App Service

Managed web hosting. Deployment slots for zero-downtime releases

💾

Azure Backup

Recovery Services vault. Policy-based schedule + retention

### The Network & Monitoring Bridge

Networking and Monitoring — where traffic and health are watched

🕸️

VNets & NSGs

Subnets segment the VNet. NSGs filter by 5-tuple priority rules

⚖️

Load Balancer & App Gateway

L4 vs L7. App Gateway adds WAF and URL routing

🔗

Peering & VPN Gateway

Peering = direct, non-transitive. VPN = encrypted hybrid link

📊

Azure Monitor

Metrics = real-time numbers. Logs = KQL-queried detail in Log Analytics

🔍

Network Watcher

IP flow verify, NSG diagnostics, connection troubleshoot, packet capture

Section 7 / Pattern Recognition

## Pattern Spotter

Decision trees and trigger-answer pairs — see the pattern, know the answer.

Which Storage Redundancy Option?

Which Storage Redundancy Option?  
  ├── Cheapest option, single datacentre is acceptable → LRS (Locally Redundant Storage)  ├── Protect against datacentre failure, stay in-region → ZRS (Zone-Redundant Storage)  ├── Protect against regional disaster, async replica in paired region → GRS (Geo-Redundant Storage)  ├── Need to read from the secondary region → RA-GRS or RA-GZRS  └── Maximum resilience: zones + geo-replication → GZRS (Geo-Zone-Redundant Storage)

Which Compute Deployment?

Which Compute Deployment?  
  ├── Need full OS access or legacy app compatibility → Virtual Machine (IaaS)  ├── Traffic varies and needs automatic instance scaling → VM Scale Set  ├── Web app, no OS management needed → App Service  ├── Run a container quickly without orchestration → Azure Container Instances (ACI)  └── Orchestrate many containers at scale → Azure Kubernetes Service (AKS)

Which Network Security Tool?

Which Network Security Tool?  
  ├── Basic allow/deny at subnet or NIC level → Network Security Group (NSG)  ├── Group VMs by role instead of hardcoding IPs in rules → Application Security Group (ASG)  ├── Centralised, FQDN-aware egress filtering for a hub-spoke design → Azure Firewall  ├── HTTP/S filtering with WAF and URL-based routing → Application Gateway (WAF\_v2 SKU)  └── Mitigate volumetric/network-layer DDoS attacks → Azure DDoS Protection (Standard)

Which Azure Monitor Tool?

Which Azure Monitor Tool?  
  ├── Need near-real-time numeric trend (CPU %, disk IOPS) → Azure Monitor Metrics  ├── Need deep, queryable diagnostic detail over time → Azure Monitor Logs (Log Analytics + KQL)  ├── Notify a team when a threshold is breached → Alert rule + action group  ├── Get proactive recommendations across cost/security/performance → Azure Advisor  └── Diagnose a specific network connectivity failure → Network Watcher (IP flow verify / connection troubleshoot)

## Decision Cards

“management group” or “policy inheritance across subscriptions”→Management groups — organise subscriptions for RBAC/Policy inheritance

“resource lock” or “prevent accidental deletion”→CanNotDelete or ReadOnly lock — overrides RBAC, even for Owners

“dynamic group” or “rule-based membership”→Entra ID dynamic group with a membership rule

“GZRS” or “zone + geo redundant”→Geo-Zone-Redundant Storage (GZRS) — zones plus paired-region replication

“archive tier” or “rehydrate”→Archive access tier — offline, cheapest, hours to rehydrate

“SAS token” or “time-limited access without keys”→Shared Access Signature (SAS)

“fault domain” vs “update domain”→Availability set — fault domain (hardware), update domain (patching)

“scale automatically based on CPU”→VM Scale Set autoscale rule

“non-transitive” networking→VNet peering — does not transit through a third peered VNet

“KQL” or “query log data”→Log Analytics workspace queried with Kusto Query Language

Ready to certify?

## Train with practitioners, not presenters

Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day.

🎯

Tailored Content

Training built around your actual Azure tenant, your workloads, and your operational challenges — not generic slides.

🛠️

Hands-On Labs

Configure RBAC and governance, design storage redundancy, deploy scale sets, and build hub-spoke networking in guided lab environments.

📈

Exam + Capability

Pass the AZ-104 exam and build lasting Azure administration skills your team can apply from day one.

[Talk to us about Azure Administrator training](https://lucidlabs.com.au/?service=training-consulting&message=I%27m%20interested%20in%20Azure%20Administrator%20\(AZ-104\)%20training%20for%20my%20team%20-%20covering%20identity%2C%20governance%2C%20storage%2C%20compute%2C%20networking%2C%20and%20monitoring.#contact)

Custom training for teams & individuals — remote or on-site across Australia

![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg)

Keith Oak

Chief Technology Officer — Lucid Labs

Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day.

[LinkedIn ↗](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au ↗](https://lucidlabs.com.au/)Published 29-03-2026