AZ-104 CertReady Scorecard: Ready to Book Azure Admin?

Microsoft AZ-104 Azure Administrator is consistently rated one of the most difficult associate-level certifications in the Microsoft ecosystem. Unlike AZ-900, which tests conceptual understanding, AZ-104 tests whether you can actually administer Azure resources — configure virtual networks, manage identities in Entra ID, deploy and monitor virtual machines, implement storage solutions, and troubleshoot resource access issues. Candidates who arrive at AZ-104 with only theoretical preparation fail at a significantly higher rate than those with hands-on lab experience. The AZ-104 CertReady Scorecard evaluates your readiness across five weighted dimensions in 15 minutes, placing particular emphasis on lab and configuration readiness, and gives you a data-based answer before you spend $165 on a voucher.

What AZ-104 Actually Tests

AZ-104 is an administrator exam, not a fundamentals exam. Every domain it covers is tested at the level of applied configuration and troubleshooting, not conceptual identification. You are expected to know not just what Azure resources exist but how to deploy, configure, secure, and monitor them in realistic administrative scenarios.

The exam covers five domain areas. Manage Azure Identities and Governance accounts for 15 to 20 percent of the exam and covers Microsoft Entra ID (formerly Azure Active Directory), role-based access control, subscriptions, management groups, and Azure Policy. Implement and Manage Storage covers 15 to 20 percent and tests blob storage configuration, access tiers, lifecycle management, Azure Files, and storage security. Deploy and Manage Azure Compute Resources covers 20 to 25 percent and is the largest domain, testing virtual machine deployment, availability sets, scale sets, Azure App Service, and container instances. Configure and Manage Virtual Networking covers 25 to 30 percent and is frequently cited as the most technically demanding section, covering VNets, subnets, network security groups, Azure DNS, VPN gateways, ExpressRoute, and load balancers. Monitor and Maintain Azure Resources covers 10 to 15 percent and tests Azure Monitor, Log Analytics, alerts, and backup and recovery configuration.

According to Microsoft Learn, AZ-104 candidates should have at least six months of hands-on experience administering Azure, familiarity with core Azure services and workloads, and experience using PowerShell, Azure CLI, or ARM templates for resource management. This is one of the few Microsoft certifications that explicitly states an experience requirement rather than just a knowledge requirement — and that distinction reflects what the exam actually tests.

The exam consists of 40 to 60 questions including case studies, multiple choice, multiple select, drag and drop, and in some sittings, lab-based questions that require you to complete tasks in a live Azure environment. The lab questions, when present, are the most heavily weighted questions in the exam and cannot be skipped or returned to once submitted.

---

Why AZ-104 Has a High First-Attempt Failure Rate

AZ-104 has one of the highest first-attempt failure rates among Microsoft associate certifications, and the pattern of failure is consistent. Candidates who study through video courses and practice questions without hands-on lab time pass their practice exams comfortably and fail the live exam by a significant margin. The gap between practice score and live exam performance in AZ-104 is larger than in almost any other Microsoft certification.

The primary reason is that AZ-104 tests configuration knowledge rather than conceptual knowledge. A practice question might ask: "Which Azure service provides centralized identity management for cloud resources?" — a recall question that a video course prepares you to answer correctly. The live exam equivalent might be: "An administrator needs to allow members of a specific security group to deploy virtual machines in a resource group but not modify the network configuration. Which role assignment achieves this with the minimum necessary permissions?" — a scenario that requires you to understand RBAC roles, the principle of least privilege, and the specific permissions each built-in role grants.

The networking domain is where the largest concentration of failure occurs. Virtual networking in Azure involves VNet peering, network security group rule priority, route tables, private DNS zones, VPN gateway SKUs, and ExpressRoute circuit configurations, topics that are difficult to understand through reading alone and become clear only when you have configured them in a live environment. Candidates who have not worked in Azure or completed structured lab exercises before the exam frequently describe the networking questions as "much harder than anything in my practice exams."

A third factor is case study questions. AZ-104 case studies present an extended scenario across multiple pages, a company's existing infrastructure, its business requirements, and its technical constraints, followed by four to eight questions referencing different aspects of the scenario. Candidates who have not practiced case study format questions spend disproportionate time rereading the scenario for each question rather than having built an efficient annotation strategy. This time drain compounds the difficulty of the already technical questions.

---

The Five Readiness Dimensions for AZ-104

The AZ-104 CertReady Scorecard evaluates readiness across five weighted dimensions, calibrated to AZ-104's specific domain structure and its emphasis on applied configuration knowledge.

Practice Exam Performance — 35% weight: Your most recent full-length AZ-104 practice exam score and your average across your last three attempts, completed in timed exam mode on a calibrated question bank. For AZ-104, the live exam is significantly harder than most commercial practice banks. A reliable passing threshold on a well-calibrated AZ-104 practice exam is 82% or above. Candidates scoring 75% to 80% on practice exams are at meaningful risk on the live exam, particularly if their practice questions skew toward recall rather than configuration scenarios.

Domain Coverage — 25% weight: A self-assessment of your confidence across all five AZ-104 domains, weighted against their exam percentages. The scorecard gives particular weight to Configure and Manage Virtual Networking (25 to 30% of the exam and the highest-failure domain) and Deploy and Manage Azure Compute Resources (20 to 25%). Candidates who are strong in identity management and storage but weak in networking are clearly flagged by this dimension — and the networking domain weight means this gap has outsized impact on the total readiness score.

Lab and Configuration Readiness — 20% weight: This dimension is unique to the AZ-104 scorecard and carries the highest differentiation power of any single dimension across the four CertReady Scorecards. It evaluates whether you have hands-on experience deploying and configuring resources across all five AZ-104 domains — not whether you know what those resources do, but whether you have actually done it. The checklist covers ten specific configuration tasks: VNet and subnet creation, NSG rule configuration, VNet peering, virtual machine deployment with managed disks, scale set configuration, Azure Files share setup, blob storage lifecycle policy, RBAC role assignment, Azure Policy creation, and Azure Monitor alert configuration. Candidates who have completed all ten in a real or lab Azure environment score significantly higher in this dimension than those who have only studied the concepts.

Command and Resource Recall — 10% weight: AZ-104 expects familiarity with Azure CLI and PowerShell syntax at a recognition level — you are not expected to write commands from memory, but you should be able to identify what a given command does and select the correct command from options for a described administrative task. This dimension evaluates how comfortable you are with AZ CLI and PowerShell command patterns and whether you can rapidly recall the key parameters for common resource management operations.

Final 7-Day Study Habits — 10% weight: Your pre-exam preparation in the week before your test date. For AZ-104, this dimension focuses on whether you are completing configuration practice rather than passive review, and whether you are drilling the networking domain specifically in the final week. Candidates who spend their final week on video review rather than active configuration practice consistently perform worse on AZ-104's scenario and lab questions than those who spend the same time doing hands-on tasks.

---

What the AZ-104 CertReady Scorecard Contains

The AZ-104 CertReady Scorecard is a self-contained HTML file that runs in your browser without an internet connection or account. It contains five interactive tabs structured around AZ-104's specific preparation requirements.

Tab 1 — PDF Guide: A reference document covering the AZ-104 exam structure, domain weightings, the five-dimension readiness framework, score band definitions, and AZ-104-specific guidance on case study strategy, lab question handling, and the networking domain preparation approach. This tab is more detailed than the equivalent guides in the AZ-900 and CLF-C02 scorecards because AZ-104's complexity warrants more context. Read it fully before entering any data into the calculator.

Tab 2 — Score Calculator: The weighted readiness calculator for AZ-104. You input your practice exam scores, domain confidence ratings across all five AZ-104 domains, your lab and configuration experience across the ten key tasks, your CLI and PowerShell command familiarity, and your study habit assessment. The calculator applies AZ-104's specific dimension weights — with Lab and Configuration Readiness carrying its unique 20% weighting — and produces a live total readiness score with a visual score meter.

Tab 3 — Lab and Configuration Readiness: The most distinctive tab in any DiviTrain CertReady Scorecard. Rather than a general scenario checklist, this tab walks you through ten specific configuration tasks that appear most frequently in AZ-104 lab questions and scenario questions. For each task, you rate whether you have completed it in a live environment, how recently, and your confidence in completing it under time pressure. The tab produces a configuration readiness rating that directly feeds into your total score and into the booking decision in Tab 5.

Tab 4 — 7-Day Fix Plan: Four structured day-by-day study plans calibrated to AZ-104, one per score band. The AZ-104 plans differ fundamentally from other scorecard fix plans — they are built around hands-on configuration practice rather than content review. Each day specifies which configuration tasks to complete, recommended resources including Microsoft Learn's AZ-104 learning path, and how to use the Azure free tier or a trial subscription to complete lab work without additional cost.

Tab 5 — Booking Decision: The final output. A criteria checklist combining your total score, lab readiness rating, and study habit assessment produces one of three recommendations: Book Now, Wait 7 Days, or Delay. For AZ-104, this tab also includes a specific flag for the networking domain — if your domain confidence in virtual networking is below a threshold regardless of your total score, the tab flags this as a risk factor that warrants targeted attention before booking.

---

Score Bands and What They Mean

The AZ-104 CertReady Scorecard uses the same four-band structure as all DiviTrain CertReady Scorecards, calibrated to AZ-104's passing requirements and its emphasis on applied configuration knowledge.

85 and above — Book Now: Your preparation data across all five dimensions — including lab and configuration readiness — is consistent with exam-ready performance for AZ-104. Book your exam at Pearson VUE. In the final days before your exam, complete one or two targeted configuration tasks in the networking domain to keep your hands-on knowledge fresh, review RBAC built-in roles and their permission boundaries, and do one full timed practice exam in exam mode without pausing.

70 to 84 — Consider Booking: Your overall preparation is close to exam-ready but one dimension is holding your score below the Book Now threshold. For AZ-104 candidates in this band, the most common limiting dimension is Lab and Configuration Readiness rather than domain knowledge. One week of targeted hands-on practice on the specific configuration tasks where your Tab 3 rating was lowest is typically enough to move into the Book Now band — more so than additional video review or practice questions.

55 to 69 — Wait 7 Days: Your Azure knowledge is in place but your configuration experience and networking domain coverage have identifiable gaps. Use the 7-Day Fix Plan from Tab 4. The AZ-104 plan at this band is heavily weighted toward hands-on lab work — specifically VNet configuration, NSG rule management, and virtual machine deployment tasks. After completing the plan, take a fresh full-length practice exam and rerun the scorecard before booking.

Below 55 — Delay and Study: Your current readiness level carries significant risk of a first-attempt failure on AZ-104. This is particularly true if your lab and configuration readiness score was low — AZ-104 is not an exam that can be passed through additional practice question work alone. Structured hands-on training is the most efficient path to closing this gap. DiviTrain's AZ-104 Azure Administrator training includes hands-on lab environments alongside Skillsoft e-learning and MeasureUp practice exams, specifically addressing the configuration experience gap that self-study candidates most commonly face.

---

Lab Readiness: The Defining Factor in AZ-104

Lab readiness is the single dimension that most reliably separates AZ-104 candidates who pass from those who fail, and it is the dimension that standard practice exam scores least effectively measure. A candidate can score 82% on a well-designed AZ-104 practice exam and still fail the live exam if their score reflects strong recall on conceptual questions but weak performance on applied configuration scenarios.

The ten configuration tasks in the AZ-104 CertReady Scorecard's Lab Readiness tab were selected because they appear most frequently in AZ-104 lab questions and scenario questions, and because they represent the tasks where first-attempt failure candidates most commonly report feeling unprepared. They are not exhaustive — AZ-104 covers a broader range of configuration tasks — but they are the tasks with the highest predictive value for lab question performance.

The most commonly failed configuration task area in AZ-104 is virtual network configuration. Setting up VNet peering, configuring route tables to override default routing, creating private DNS zones and linking them to VNets, and implementing Azure Bastion for secure VM access are all tasks that candidates who have only studied through video content struggle to complete accurately under timed exam conditions. The difficulty is not conceptual — most candidates understand what these components do — the difficulty is procedural: knowing the exact sequence of steps, the required parameter values, and the common error states that indicate a misconfiguration.

The second most commonly failed area is RBAC implementation. AZ-104 scenario questions frequently present a permission requirement and ask which built-in role assignment achieves it with minimum necessary permissions. The distinction between Owner (full access including role assignment), Contributor (full resource access, no role assignment), Reader (read-only), and specialized roles like Network Contributor, Virtual Machine Contributor, and Storage Account Contributor must be understood at a level of precision that only comes from having applied them in real administrative scenarios.

If you have not yet completed hands-on Azure configuration work, the Azure free account provides 12 months of free access to popular services and $200 credit for the first 30 days — sufficient to complete all ten configuration tasks in the scorecard's lab readiness checklist. DiviTrain's AZ-104 Azure Administrator training includes structured lab environments that guide you through these tasks with step-by-step scenarios, removing the setup overhead of working from scratch in a free Azure account.

For context on how this lab-focused approach compares to the other certifications in the DiviTrain CertReady Scorecard range, see the complete CertReady Scorecard guide. If you are earlier in your Azure journey, DiviTrain also offers scorecards for AZ-900 Azure Fundamentals — the recommended starting point before AZ-104. Additional scorecards are available for CompTIA Security+ SY0-701 and AWS Cloud Practitioner CLF-C02.

---

The 7-Day Fix Plan for AZ-104

The AZ-104 7-Day Fix Plan is the most hands-on focused plan across all four DiviTrain CertReady Scorecards. Where the AZ-900 and CLF-C02 plans are built around scenario practice and domain review, the AZ-104 plan is built around configuration tasks because AZ-104's exam performance is more directly correlated with hands-on experience than with additional content study.

For candidates in the Wait 7 Days band (55-69), the plan allocates three of the seven days to hands-on configuration practice. Day 1 covers virtual networking: deploy a VNet with multiple subnets, configure an NSG with inbound and outbound rules, create a VNet peering connection between two VNets, and set up a route table overriding default routing. Day 2 covers identity and governance: create Entra ID users and groups, assign RBAC roles at different scopes (subscription, resource group, resource), create a custom Azure Policy, and test a deny effect policy on a resource deployment. Day 3 covers compute and storage: deploy a virtual machine with a managed disk, configure an availability set, create an Azure Files share with SMB access, and configure a blob storage lifecycle management policy. Day 4 is a full-length timed practice exam in exam mode. Day 5 reviews the questions from Day 4 with particular focus on any networking or RBAC questions answered incorrectly. Day 6 repeats the one configuration task area where Day 3 and Day 5 review showed the most weakness. Day 7 is light review only.

For candidates in the Consider Booking band (70-84), the plan is more targeted. If the limiting dimension is Lab and Configuration Readiness, Days 1 and 2 focus on the specific configuration tasks that scored lowest in Tab 3. If the limiting dimension is Domain Coverage in virtual networking, Days 1 and 2 cover VNet configuration and NSG rule management only. The plan then converges on a fresh practice exam on Day 4 and booking confirmation on Day 7.

Both plans include case study strategy guidance: read the requirements and constraints sections of the case study first before reading the infrastructure description, annotate each requirement as you read it, and answer the questions in the order presented rather than jumping between them. This approach consistently outperforms unstructured case study reading under exam time pressure.

---

The DiviTrain Advantage

If your AZ-104 CertReady Scorecard shows you need more structured preparation — especially in hands-on lab experience — DiviTrain's AZ-104 Azure Administrator training gives you everything you need to close the gap:

• Expert tutor support available 24/7 — Get help whenever you need it, with personalized guidance from experienced IT professionals.
• MeasureUp Practice Exams (60 days access) — Take full-length exams in certification mode with scenario questions aligned to current AZ-104 objectives and difficulty level.
• 365 days of access — Learn at your own pace without time pressure. Re-watch modules, retake exams, review materials anytime.
• Hands-on labs (where applicable) — Practice real-world Azure administration scenarios in structured lab environments before your certification exam.

---

Frequently Asked Questions

Do I need to pass AZ-900 before taking AZ-104?

AZ-900 is not a formal prerequisite for AZ-104. Microsoft allows candidates to take AZ-104 without holding AZ-900. However, AZ-104 assumes a solid understanding of Azure fundamentals — core services, resource management, identity concepts, and subscription structure — that AZ-900 directly covers. Candidates without this foundation typically require significantly more study time for AZ-104 than those who completed AZ-900 first. If you are new to Azure, completing AZ-900 before AZ-104 is the more efficient path.

Does AZ-104 include live lab questions in the exam?

AZ-104 may include lab-based questions that require you to complete actual configuration tasks in a live Azure environment within the exam interface. Not every AZ-104 sitting includes lab questions — Microsoft does not publish which question sets include them. When lab questions do appear, they are typically presented at the beginning of the exam, cannot be skipped, and cannot be returned to once submitted. They carry significant weight in the exam score. The AZ-104 CertReady Scorecard's Lab Readiness tab is specifically designed to evaluate your preparedness for this question format.

How much hands-on Azure experience do I need before taking AZ-104?

Microsoft recommends at least six months of hands-on Azure administration experience. In practice, the specific tasks that matter most are the ones the exam tests — VNet configuration, RBAC implementation, virtual machine deployment, and Azure Monitor setup. Candidates with three to four months of structured lab practice covering these areas consistently outperform candidates with six months of passive Azure exposure that did not include deliberate configuration work. Quality of hands-on experience matters more than duration.

What is the passing score for AZ-104?

The Microsoft AZ-104 passing score is 700 on a scale of 100 to 1000. The AZ-104 CertReady Scorecard's Book Now band (85+) is calibrated to correlate with preparation levels typically associated with scoring above 700 on the live exam, accounting for AZ-104's difficulty gap between practice exams and live exam performance. Candidates in the Book Now band who have strong lab readiness scores consistently perform at or above passing level on the live exam.

How does the AZ-104 scorecard compare to the AZ-900 scorecard?

The AZ-104 scorecard is significantly more complex than the AZ-900 scorecard, reflecting the difference in exam difficulty. The most visible difference is the Lab and Configuration Readiness dimension, which replaces the Service Recall dimension from AZ-900 and carries 20% of the total score. The AZ-104 scorecard's PBQ tab is replaced by a hands-on configuration checklist covering ten specific admin tasks. The AZ-900 scorecard is built around conceptual readiness and scenario question fluency. The AZ-104 scorecard is built around applied configuration competence and domain coverage in technical networking and identity topics.

Do I need to know PowerShell or Azure CLI to pass AZ-104?

You do not need to write PowerShell or CLI commands from memory. AZ-104 tests command recognition and parameter identification — you may be asked to identify what a given command does, select the correct command from options for a described task, or recognize an error in a provided command. Candidates who have used Azure CLI or PowerShell in lab practice can answer these questions from experience. Candidates who have only used the Azure Portal are at a disadvantage on this question type and should complete at least basic CLI practice before booking.

What certification should I pursue after passing AZ-104?

AZ-104 is a prerequisite or recommended foundation for several Microsoft expert-level certifications. The most common next step for Azure administrators is AZ-305 Azure Solutions Architect Expert, which tests architecture design rather than administration. For security-focused administrators, AZ-500 Azure Security Technologies is the natural progression and builds directly on the identity, networking, and monitoring knowledge from AZ-104. For development-focused candidates, AZ-204 Azure Developer Associate is a common parallel certification alongside AZ-104.

What is the refund policy for the AZ-104 CertReady Scorecard?

The AZ-104 CertReady Scorecard is covered by DiviTrain's 14-Day Money-Back Policy. If you purchase the scorecard and are not satisfied, you can request a refund within 14 days of purchase. Access is activated after purchase and the file is delivered digitally.

---

About the Author

DiviTrain is an international IT learning platform with nearly 20 years of experience in professional IT training. Our courses are developed by Skillsoft, the global leader in enterprise learning, ensuring high-quality, industry-relevant content. You get access to hands-on practice labs (where applicable), expert tutor support available 24/7, and official MeasureUp practice exams — all backed by DiviTrain's commitment to your certification success. Whether you're pursuing your first certification or advancing your career in cloud infrastructure and Azure administration, DiviTrain provides the complete tools, guidance, and support you need to succeed.

---