AZ-104 April 2026 Update: Key Changes
On April 17, 2026, Microsoft rolled out a significant update to the AZ-104 Microsoft Azure Administrator exam. This isn’t a complete rewrite of the exam — the five core domains remain the same — but the update adds new topics reflecting how the Azure administrator role has evolved. If you’re studying with materials from before April 2026, you’re preparing for an outdated exam. The most notable additions include Azure Container Apps, Azure Arc hybrid management, AI service administration, and a stronger emphasis on Bicep over ARM JSON templates.
Microsoft confirmed on the official AZ-104 study guide that the skills measured document was updated effective April 17, 2026. The exam continues to cost $165 USD, requires a passing score of 700 out of 1000 using scaled scoring, and grants a certification valid for one year with free annual renewal via an online assessment on Microsoft Learn.
The update reflects a broader shift in what organizations expect from Azure administrators. The role is no longer purely IaaS-focused. Administrators are now expected to manage PaaS workloads, containerized applications, hybrid environments connected through Azure Arc, and basic AI service deployments. According to Mark O’Shea’s AZ-104 resource guide on intunedin.net, some IaaS workloads are slowly being moved to PaaS offerings, and the exam now tests your ability to navigate that transition.
Updated Exam Blueprint Breakdown
The AZ-104 exam retains its five-domain structure, but the weighting and content within each domain has shifted. Here’s the current breakdown based on the official Microsoft Learn study guide:
| Domain | Weight | Key Changes |
|---|---|---|
| Manage Azure identities and governance | 20–25% | External IDs (B2B/B2C), Entra ID Protection, Policy as Code |
| Deploy and manage compute resources | 20–25% | Container Apps, Azure Arc, AI service management |
| Implement and manage storage | 15–20% | Advanced lifecycle policies, tag-based tier migration |
| Implement and manage virtual networking | 15–20% | ExpressRoute Direct, Virtual WAN, advanced Bastion |
| Monitor and maintain Azure resources | 10–15% | AI-driven monitoring, advanced KQL, Backup Center |
The two heaviest domains — identity and compute — each carry 20–25% of the exam weight. That means nearly half your score comes from these two areas alone. If you’re short on study time, prioritize identity management (Microsoft Entra ID, RBAC, governance) and compute (VMs, containers, App Service, ARM/Bicep). Together, they can make or break your result.
New Topics You Must Study
The April 2026 update introduces several topics that were not previously tested. If you’ve been studying from older materials, you need to fill these gaps before exam day.
Azure Container Apps and Container Instances
The compute domain now explicitly includes provisioning and managing Azure Container Apps alongside the previously covered Azure Container Instances. You should understand when to use each service, how to configure scaling rules, and how Azure Container Registry integrates with both. Be prepared for questions comparing Container Apps (serverless, microservices-oriented) versus Container Instances (simple, single-container workloads).
Azure Arc for Hybrid Management
Azure Arc has been added across multiple domains. You need to know how to use Azure Arc to manage on-premises servers, multi-cloud virtual machines, and Kubernetes clusters from the Azure control plane. According to SPOTO’s analysis of the AZ-104 update, Azure Arc implementation for on-premises and multi-cloud environments is now a testable objective in the compute domain.
AI Service Administration
This is the most controversial addition. The updated objectives include managing Azure OpenAI deployments and configuring access control for Azure AI services (formerly Cognitive Services). However, note that commenters on the dev.to AZ-104 update article have disputed whether Copilot administration is actually included. The safe approach: study the official Microsoft Learn study guide and focus on what’s listed there — deployment and access control for Azure AI Services, not deep AI engineering.
External Identities and Entra ID Protection
The identity domain now covers External IDs (B2B and B2C scenarios), guest user management, federated authentication with third-party identity providers, and Entra ID Protection for risk-based conditional access. These additions reflect the reality that most enterprises manage hybrid identity environments with external partners and need risk-based access policies.
Bicep Over ARM JSON
While both Bicep and ARM JSON templates are still tested, the exam is clearly shifting emphasis toward Bicep. You should be comfortable reading, modifying, and deploying Bicep files. Know how to convert ARM JSON to Bicep using the Bicep CLI. According to SPOTO’s AZ-104 update breakdown, Bicep application has been strengthened across all resource deployment scenarios.
What Was Removed From the Exam
Alongside the additions, some older topics have been removed or de-emphasized. Understanding what’s no longer tested saves you from wasting study hours on irrelevant material.
Traditional Azure AD PowerShell module: The old AzureAD PowerShell module has been removed from exam objectives. You’re now expected to use the Microsoft Graph PowerShell SDK for all identity management tasks. If your study materials reference Connect-AzureAD or Get-AzureADUser, update those to Connect-MgGraph and Get-MgUser.
Chef and Puppet configuration management: These third-party configuration management tools have been dropped. The exam now focuses on Azure Automation and Ansible integration for configuration management. This aligns with the broader industry move away from agent-based configuration management in cloud-native environments.
Basic networking concepts: While networking content hasn’t been explicitly removed, the intunedin.net resource guide notes that basic networking knowledge is now assumed rather than taught. You won’t see introductory questions about IP addressing or subnetting — you’re expected to already know this. The exam tests advanced networking scenarios like VNet peering topologies, service endpoints versus private endpoints, and hybrid connectivity via ExpressRoute and VPN gateways.
Hands-On Lab Setup Guide
The AZ-104 is a practical exam. Studying theory alone will not get you a passing score. You need hands-on experience with the Azure portal, CLI, and PowerShell. Here’s a lab setup that covers every exam domain without costing you a fortune.
Free Tier and Sandbox Strategy
Start with the Azure free account, which gives you $200 in credits for the first 30 days plus 12 months of popular free services. Use this for your intensive lab weeks. After the free credits expire, use the Microsoft Learn sandbox environment, which provides temporary Azure access for specific exercises without requiring a subscription.
Essential Labs by Domain
Identity (Weeks 1–2): Create a Microsoft Entra ID tenant. Add users and groups, including dynamic groups. Configure a custom RBAC role and assign it at the subscription scope. Set up self-service password reset. Create a conditional access policy. Implement Entra ID Protection risk policies. These tasks map directly to exam questions you’ll face.
Compute (Weeks 3–4): Deploy a VM using both the portal and Bicep. Configure availability sets and availability zones. Create a VM scale set with autoscaling rules. Deploy Azure Container Instances and Azure Container Apps. Set up an App Service with deployment slots. Practice moving a VM between resource groups and subscriptions.
Networking (Weeks 5–6): Build a multi-VNet topology with peering. Create NSGs with inbound and outbound rules. Configure Azure Bastion for secure VM access. Set up a load balancer (both public and internal). Deploy an Application Gateway. Configure a site-to-site VPN gateway. Test DNS resolution with Azure private DNS zones.
Storage (Weeks 5–6): Create storage accounts with different redundancy options (LRS, ZRS, GRS, RA-GRS). Configure blob lifecycle management policies. Set up Azure File Sync. Create and test SAS tokens. Configure storage firewalls and service endpoints.
Monitoring (Week 7): Set up Azure Monitor with log analytics workspaces. Create alert rules with action groups. Write basic KQL queries to query log data. Configure Azure Backup for a VM. Review Azure Advisor recommendations.
8-Week Study Plan for AZ-104
Based on the updated exam objectives and feedback from candidates who’ve taken the post-April 2026 version, here’s a structured 8-week plan. This assumes you can commit 10–15 hours per week.
| Week | Focus Area | Key Activities |
|---|---|---|
| 1 | Identity foundations | Entra ID users, groups, dynamic groups, administrative units, SSPR |
| 2 | Governance and access | RBAC (built-in and custom roles), Azure Policy, resource locks, cost management, management groups |
| 3 | Compute resources | VMs (creation, sizing, encryption, availability sets/zones), VM scale sets |
| 4 | Containers and App Service | Container Instances, Container Apps, ACR, App Service plans, deployment slots |
| 5 | Networking | VNets, subnets, peering, NSGs, ASGs, Bastion, load balancers, DNS |
| 6 | Storage | Storage accounts, redundancy, tiers, lifecycle policies, Azure Files, File Sync, SAS tokens |
| 7 | Monitoring and new content | Azure Monitor, Log Analytics, KQL, Backup, AI services admin, Azure Arc basics |
| 8 | Practice exams and review | Two full timed practice exams, review all wrong answers, revisit weak domains |
During weeks 3 through 7, spend at least half your study time in the Azure portal doing hands-on work. Read the Microsoft Learn documentation for each objective, then immediately practice the skill in your lab environment. The exam tests whether you can perform tasks, not whether you’ve memorized documentation.
For practice exams, use the free practice assessment available on Microsoft Learn. This gives you question formats that closely mirror the real exam. Supplement with a third-party practice exam provider for additional question coverage — our ranking of the best IT certification practice tests for 2026 has specific recommendations. Be cautious of brain dump sites — their questions are often inaccurate and studying from them can work against you.
Common Mistakes That Cost Exam Takers
The AZ-104 has a pass rate that candidates generally estimate between 40–60% on first attempt. Based on community feedback and the updated exam objectives, here are the mistakes that repeatedly cost candidates their passing score.
Neglecting Networking Fundamentals
The number one failure reason, according to the intunedin.net AZ-104 guide, is a lack of core networking skills. Many candidates come from Windows server administration or helpdesk backgrounds and have weak networking knowledge. The exam assumes you understand subnetting, CIDR notation, DNS resolution, and routing. If you can’t confidently calculate subnet ranges or explain the difference between a service endpoint and a private endpoint, you need to invest serious time in networking before exam day.
Studying Only Theory
The AZ-104 includes scenario-based questions, drag-and-drop exercises, and case studies that test practical application. Reading documentation without doing the work in Azure will leave you unprepared for these question types. Every objective on the official study guide should be something you’ve done in a lab environment at least once.
Confusing Similar Services
The exam deliberately tests your ability to distinguish between similar Azure services. Know the difference between:
- NSGs vs ASGs: Network Security Groups filter traffic by IP/port; Application Security Groups group VMs logically for NSG rules
- Service endpoints vs Private endpoints: Service endpoints use public IPs on the Microsoft backbone; Private endpoints use private IPs from your VNet address space
- Availability sets vs Availability zones: Sets protect against hardware failure in one datacenter; Zones protect against datacenter failure across physical locations
- LRS vs ZRS vs GRS vs RA-GRS: Understand each replication type, failover behavior, and when to recommend each one
Ignoring the Monitoring Domain
Monitoring carries only 10–15% of the exam weight, but the dev.to AZ-104 study guide notes these are “some of the easiest points” if you’ve used Azure Monitor and Log Analytics. Don’t skip this domain. Learn to write basic KQL queries, configure alert rules with action groups, and understand Azure Advisor recommendations. This is low-effort, high-reward study time.
Salary and Career Impact
The AZ-104 is Microsoft’s most popular role-based certification and serves as the prerequisite for advanced certifications like the AZ-305 Solutions Architect Expert and the AZ-400 DevOps Engineer Expert. Completing the AZ-104 opens a clear progression path through the Azure certification stack. If you’re new to Azure entirely, consider starting with the AZ-900 Microsoft Azure Fundamentals before diving into the administrator-level material.
According to KnowledgeHut’s Azure Administrator salary data for 2026, the average salary range for Azure administrators is $87,000 to $147,000 per year, depending on experience and location. Entry-level professionals (0–3 years) earn an average of $80,000, while those with 8+ years of experience average $125,000. ZipRecruiter data from June 2026 shows the average hourly rate for AZ-104 certified professionals at $58.40 per hour, which translates to approximately $121,500 annually.
The certification also serves as a gateway to higher-paying specialized roles. Azure Cloud Engineers average $163,000 per year, and Cloud Architects average $153,000, according to KnowledgeHut. Moving from AZ-104 to AZ-305 (Solutions Architect Expert) can increase your earning potential to an average of $133,000, making the AZ-104 a high-ROI investment for anyone pursuing a cloud career.
Azure continues to be the second-largest cloud provider globally, and Glassdoor data shows strong demand for certified administrators across enterprises, government agencies, and managed service providers. The combination of hybrid cloud management (Azure Arc) and AI service administration skills tested in the updated exam reflects what hiring managers are actively looking for in 2026. For a broader perspective on cloud career paths, see our Google Cloud Associate Engineer study plan for comparison with the GCP certification track.
Final Preparation Tips
In the final week before your exam, focus on these high-yield activities rather than trying to learn new topics:
- Review the official skills measured document on Microsoft Learn line by line. If any objective is unfamiliar, that’s your study priority.
- Take at least two full-length practice exams under timed conditions. The exam runs approximately 120 minutes with 40–60 questions. Practice managing your time.
- Review Bicep syntax — be able to read and identify errors in Bicep files. The exam won’t ask you to write Bicep from scratch, but you will need to interpret and modify existing templates.
- Memorize key limits and defaults — know the maximum number of VNets per subscription, the default SKU for new resources, and common port numbers. These show up in straightforward knowledge questions that are easy points.
- Rest the night before. The AZ-104 tests practical problem-solving under time pressure. Fatigue will hurt your performance more than any last-minute cramming will help.
The AZ-104 remains one of the best-value certifications in cloud computing. The April 2026 update makes it more relevant to what Azure administrators actually do on the job. Study the new objectives, get your hands dirty in a real Azure environment, and walk into the exam with confidence.
References
- Microsoft Learn — AZ-104 Official Study Guide
- intunedin.net — AZ-104 Exam Resource Guide (April 2026 Update)
- DEV Community — AZ-104 April 2026 Update: What Changes and Study Plan
- SPOTO — 2026 Microsoft AZ-104 Exam Update
- KnowledgeHut — Azure Administrator (AZ-104) Salary in 2026
- ZipRecruiter — Azure 104 Jobs and Salary Data (June 2026)