AZ-104 Study Hub

What is it?

Microsoft Entra ID is Microsoft's cloud identity and access management service. It manages identities, authentication and access to Azure and other applications.

You should understand

Know how administrators manage

• Create and manage users.
• Create security groups.
• Assign users to groups.
• Use groups when assigning access.
• Understand guest users.
• Understand bulk user management concepts.

The core model

Know these scopes

• Management group
• Subscription
• Resource group
• Individual resource

Important built-in roles

Hierarchy

Management groups allow governance and policy to be applied across multiple subscriptions.

Purpose

Azure Policy evaluates resources against organisational rules and can audit or enforce desired configurations.

Know the difference

• RBAC: Who can perform an action?
• Policy: What configurations are allowed or required?

Typical scenarios

• Restrict allowed regions.
• Require tags.
• Audit resource configurations.
• Enforce security requirements.

• Understand tags as metadata.
• Use tags for cost allocation.
• Use tags for organisation and reporting.
• Understand that tags are not security controls.
• Understand Azure Policy can enforce tagging requirements.

Know the architecture

You should understand

• Storage account types.
• Performance tiers.
• Replication.
• Access tiers.
• Security settings.
• Networking options.
• Encryption.

Know

• Containers.
• Blobs.
• Hot access tier.
• Cool access tier.
• Cold access tier.
• Archive tier.
• Lifecycle management.
• Blob versioning.
• Soft delete.
• Snapshots.

Azure Files provides managed file shares accessible using protocols such as SMB. It is useful when applications need a shared filesystem rather than object storage.

• File shares.
• SMB.
• NFS concepts.
• Mounting file shares.
• Identity-based access.
• Snapshots.

Understand

• Storage account keys.
• Shared Access Signatures.
• Stored access policies.
• Microsoft Entra-based access.
• Encryption.
• HTTPS requirements.
• Public access controls.

Know the concepts

• LRS — locally redundant storage.
• ZRS — zone-redundant storage.
• GRS — geo-redundant storage.
• GZRS — geo-zone-redundant storage.
• Read-access variants.

Know the VM lifecycle

Study

• VM sizes.
• Operating system images.
• Managed disks.
• Disk types.
• VM networking.
• Extensions.
• Availability options.
• Scaling.
• Start / stop / restart operations.

• Standard HDD.
• Standard SSD.
• Premium SSD.
• Ultra Disk concepts.
• Disk snapshots.
• Disk encryption.
• Disk performance concepts.

Think about failure domains

• Fault domains.
• Update domains.
• Availability zones.
• Regional considerations.

VM Scale Sets allow administrators to manage groups of load-balanced VM instances and scale them based on demand.

• Instance counts.
• Autoscaling.
• Scaling rules.
• VM images.
• Load balancing.

• App Service plans.
• Web apps.
• Deployment settings.
• Deployment slots.
• Scaling.
• Certificates and custom domains.
• Application settings.
• Backup concepts.

• Container images.
• Azure Container Registry.
• Azure Container Instances.
• Container Apps concepts.
• Container networking.

Core structure

• Address spaces.
• Subnets.
• Private IP addresses.
• Public IP addresses.
• Network interfaces.
• DNS settings.

Know the rule model

• Inbound rules.
• Outbound rules.
• Priority.
• Source.
• Destination.
• Protocol.
• Port.
• Allow / deny.

• System routes.
• User-defined routes.
• Route tables.
• Next hop types.
• Default routes.
• Traffic forwarding.

VNet peering allows Azure virtual networks to communicate using the Azure backbone network.

• Same-region peering.
• Global VNet peering.
• Peering configuration.
• Traffic considerations.

• DNS zones.
• DNS records.
• Record types.
• Private DNS zones.
• VNet links.
• Name resolution.

• Point-to-site VPN.
• Site-to-site VPN.
• VPN gateways.
• Local network gateways.
• Connection concepts.
• Authentication considerations.

Know the major Azure options

• Azure Load Balancer.
• Application Gateway.
• Azure Front Door concepts.
• Traffic distribution.
• Health probes.

Azure Monitor collects and analyses telemetry from Azure resources, applications and infrastructure.

• Metrics.
• Logs.
• Alerts.
• Activity logs.
• Diagnostic settings.
• Workbooks.

Log Analytics workspaces provide a central location for querying and analysing collected log data.

Know

• Workspaces.
• Tables.
• Queries.
• KQL concepts.
• Data sources.

• Alert rules.
• Conditions.
• Actions.
• Action groups.
• Metric alerts.
• Log alerts.

• Recovery Services vaults.
• Backup policies.
• Backup schedules.
• Retention.
• Recovery points.
• Restore operations.

Azure Site Recovery is designed for disaster recovery and workload replication.

• Replication.
• Recovery plans.
• Failover.
• Test failover.
• Failback concepts.

Azure Resource Manager provides the management layer for Azure resources.

• Resource groups.
• Resource providers.
• ARM templates.
• Deployments.
• Locks.
• Tags.

• Logical grouping of resources.
• RBAC scope.
• Policy scope.
• Lifecycle considerations.
• Resource group deletion.
• Resource movement concepts.

• CanNotDelete locks.
• ReadOnly locks.
• Lock inheritance.
• Lock scope.

Be comfortable with the idea of

• Creating resources.
• Listing resources.
• Querying resource properties.
• Updating resources.
• Deleting resources.
• Using parameters.
• Working with resource IDs.