AZ-104: Microsoft Azure Administrator

Microsoft Entra ID distinguishes between Member users and Guest users to maintain a secure environment. Internal employees are typically created as Member users and receive broad access to directory features, while external collaborators are invited as Guest users with highly restricted permissions. Setting specific attributes for these profiles ensures that users receive only the exact level of access they need to complete their tasks. This separation of roles forms the foundation of a least privilege security model across the cloud environment.

Azure roles are predefined sets of permissions managed by Microsoft that define what actions can be taken on resources. Since these roles are preconfigured, you cannot alter their permissions directly. Common roles include Owner, which provides full control including permission management; Contributor, which allows resource creation and management without access delegation; and Reader, which grants view-only access. A role assignment links a role to a security principal—such as a user, a group, or an application identity like a service principal—at a specific scope. This scope can range from a broad subscription down to a resource group or an individual resource, enabling administrators to enforce the principle of least privilege.

Azure Policy enforces organizational standards by comparing resource properties to business rules written in JSON. Each rule is a policy definition that includes metadata, parameters, logical operators, property aliases, and a policy rule that determines what happens when a resource does not match the condition. To scale governance, you group multiple policy definitions into an initiative (also called a policySet). An initiative lets you assign a single object to track a broad goal such as regulatory compliance or cost management, and you can add or update policies inside the set without creating new assignments.

To set up file sharing in the cloud, you must first create a storage account, which provides the underlying resource container and infrastructure. When creating the storage account, you can select from different performance classes such as FileStorage for premium workloads or StorageV2 for standard use cases. Premium file shares run on SSD (Premium) physical media to deliver low latency and high operations per second, while standard shares run on HDD (Standard) media for cost-effective, general-purpose workloads. This choice of storage media is permanent once the account is created, requiring administrators to evaluate their applications' requirements beforehand. Standard storage accounts offer three distinct access tiers: Transaction Optimized, which is recommended for initial migrations with heavy read/write activity; Hot, which balances storage and access costs; and Cool, which minimizes storage costs but increases transaction fees.

By default, an Azure Storage account allows traffic from all networks. To restrict this, you must change the default action to deny. Once denied, you must create explicit firewall rules to permit traffic from specific sources. These rules only affect data plane operations like reading or writing blobs; control plane operations, such as managing the account, are not blocked.

To create an Azure storage account, administrators can use the Azure portal, PowerShell, or the Azure CLI. Choosing the correct account type is critical because it dictates the underlying capabilities and supported data services. For general workloads, General-purpose v2 accounts support blobs, files, queues, and tables. Specialized workloads may require premium performance, which offers options like Premium block blob for fast blob access, Premium page blob for virtual machine disks, or Premium file share for high-performance file storage.

Azure Container Registry (ACR) is a managed Docker registry that stores container images for Azure deployments. To authenticate without managing credentials, you can use a managed identity on an Azure resource such as a Linux virtual machine or an Azure Kubernetes Service (AKS) cluster. The identity can be user-assigned (created and managed separately) or system-assigned (tied to the resource’s lifecycle). The flow is: enable the identity on the resource, grant it a role like AcrPull on ACR, and then the resource uses that identity to pull images without storing any passwords.

An App Service plan represents the physical compute resources that host your web applications in Azure. When creating a plan, you must choose its region, operating system, and pricing tier, which together determine the overall cost and hardware capabilities. Azure organizes these into shared, dedicated, and isolated tiers depending on how much resource isolation your workload requires. While shared tiers use a shared CPU quota and are meant only for testing, dedicated tiers provide private virtual machines, and isolated tiers run inside a secure, dedicated virtual network.

Creating a virtual machine in Azure involves setting up several key components that work together to provide a functional, secure, and performant computing environment. The process starts in the Azure portal where you select a resource group, give the VM a name, and choose a deployment region that determines where your virtual machine physically runs. You then pick an operating system image such as Windows Server or Ubuntu Linux, and create a local administrator account with a secure username and password that meets complexity requirements.

Azure Resource Manager (ARM) templates and Bicep files automate the deployment and management of cloud resources using a declarative syntax. This means you define the desired final state of your infrastructure without writing the step-by-step commands to build it. ARM templates are written in JSON, while Bicep is a domain-specific language designed with a much cleaner syntax. Bicep files automatically compile into JSON ARM templates during deployment, ensuring full compatibility with all Azure services.

Network Security Groups (NSGs) act as a virtual firewall that filters traffic for Azure resources using a set of security rules. Each rule uses a five-tuple system—source, source port, destination, destination port, and protocol (TCP or UDP)—to decide whether to allow or deny traffic. Because NSGs are stateful, when a rule permits traffic in one direction, the return traffic is automatically allowed without needing a separate rule.

Azure DNS is a hosting service for managing your domain names. A DNS zone is the container that holds all the DNS records for a specific domain, like contoso.com. Within that zone, you create individual records that tell computers how to find your resources. For example, an A record points a name like documentation to an IPv4 address, while a CNAME record can point that same name to another domain name instead. Other common records include AAAA for IPv6 addresses, MX for mail servers, and TXT for verification text.

When you create a virtual network, you must define its address space using CIDR notation, like 10.0.0.0/16. This private IP range must not overlap with any other connected network, including on-premises or other Azure networks. You then divide this space into subnets, such as 10.0.1.0/24, to segment resources. Azure reserves the first four and the last IP in each subnet, so a small subnet like /29 provides only three usable addresses. For resources that need a fixed address, like domain controllers, you assign a static private IP; otherwise, Azure uses dynamic allocation, which can change when a virtual machine stops. A dedicated GatewaySubnet is required if you plan to deploy a VPN gateway, and you should always leave room in your address space for future expansion.

A Recovery Services vault is a central storage location in Azure for protecting workloads like virtual machines and databases. A key decision during creation is choosing a storage replication type, which locks permanently once backups are configured. You choose between Locally-redundant storage (LRS) for low-cost protection within one data center, Zone-redundant storage (ZRS) for replication across availability zones in one region, or Geo-redundant storage (GRS), the default, which copies data to a secondary paired region for maximum durability.

Azure Monitor collects and stores numerical values called metrics that describe aspects of a system at a particular point in time. These metrics are automatically gathered at regular intervals from Azure resources. The key metrics you need to interpret include CPU usage, memory usage, disk I/O, and network traffic. Each of these values directly affects the performance and health of a resource. For example, high CPU usage signals a compute bottleneck, while elevated disk I/O may indicate storage contention. Understanding what each metric represents allows you to evaluate whether a resource is operating within expected limits.