AZ-104 Interview Questions and Answers: Microsoft Azure Administrator Guide
Prepare for Azure Administrator interviews with this complete AZ-104 interview questions and answers guide covering Microsoft Entra ID, RBAC, Azure Policy, Storage, Virtual Machines, VNets, networking, monitoring, backup, security and Azure administration.
This AZ-104 interview preparation guide covers the major Azure administration domains that an Azure Administrator should understand. You will learn important concepts related to identity, governance, storage, compute, networking, monitoring, backup and troubleshooting.
1 What Is AZ-104?
AZ-104 is the Microsoft Azure Administrator certification exam. It focuses on practical Azure administration skills including managing identities, governance, storage, compute resources, networking, monitoring and maintenance.
Azure administrators work with resources such as virtual machines, storage accounts, virtual networks, Microsoft Entra ID, role-based access control, Azure Monitor and backup services.
For an interview, it is not enough to memorize Azure definitions. You should understand why a service is used, how it is configured, how it is secured and how you would troubleshoot it.
2 AZ-104 Core Skill Areas
Identity & Governance
Entra ID, users, groups, RBAC, Policy, subscriptions, resource groups, tags, locks and cost management.
Storage
Storage accounts, Blob Storage, Azure Files, redundancy, SAS, access keys, lifecycle and security.
Compute
Virtual machines, disks, availability, VM Scale Sets, App Service and containers.
Networking
VNets, subnets, NSGs, routing, DNS, peering, load balancing, Application Gateway and Bastion.
Monitoring
Azure Monitor, Log Analytics, metrics, logs, alerts and Network Watcher.
Maintenance
Backup, recovery, troubleshooting and operational management of Azure resources.
3 Identity and Governance Interview Questions
Identity and governance are fundamental parts of Azure administration. Interviewers commonly ask about Microsoft Entra ID, RBAC, Azure Policy, subscriptions, resource groups and resource locks.
1. What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It provides authentication, authorization, user and group management, application identities and access control for Microsoft cloud services and applications.
2. What is the difference between authentication and authorization?
Authentication verifies who a user or application is. Authorization determines what that authenticated identity is allowed to access or perform.
For example, signing in with an account is authentication, while having permission to create a virtual machine is authorization.
3. What is Azure RBAC?
Azure Role-Based Access Control, or RBAC, provides fine-grained authorization for Azure resources. Roles can be assigned to users, groups, service principals and managed identities at different scopes.
4. What are the scopes of Azure RBAC?
Azure RBAC can be assigned at several scopes:
- Management group
- Subscription
- Resource group
- Individual resource
Permissions inherited from a higher scope can apply to resources below that scope.
5. What is the difference between Owner, Contributor and Reader?
- Owner: Can manage resources and assign access.
- Contributor: Can manage resources but normally cannot assign Azure RBAC permissions.
- Reader: Can view resources but cannot modify them.
6. What is Azure Policy?
Azure Policy is a governance service used to enforce organizational standards and assess compliance of Azure resources.
For example, an organization can create a policy requiring resources to use approved regions or requiring specific tags.
7. What is the difference between Azure Policy and RBAC?
RBAC controls who can perform an action. Azure Policy controls whether resources comply with organizational rules.
RBAC answers: "Who can do this?"
Policy answers: "Is this resource configuration allowed or compliant?"
8. What is an Azure resource group?
A resource group is a logical container for Azure resources. Resources in a resource group can be managed together for organization, access control, deployment and lifecycle management.
9. What are Azure resource locks?
Resource locks help prevent accidental modification or deletion of Azure resources.
Common lock types include:
- CanNotDelete – prevents deletion.
- ReadOnly – prevents modifications.
10. Why are Azure tags used?
Tags are key-value metadata attached to Azure resources. Organizations commonly use tags for cost allocation, ownership, environment identification, department tracking and automation.
Example:
Environment = Production
Department = Finance
Owner = CloudTeam4 Azure Storage Interview Questions
11. What is an Azure Storage Account?
An Azure Storage Account provides a namespace for Azure Storage services. Depending on the account configuration, it can support services such as Blob Storage, Azure Files, queues and tables.
12. What is Azure Blob Storage?
Azure Blob Storage is an object storage service designed for storing large amounts of unstructured data such as documents, images, videos, backup files, logs and application data.
13. What are the different Blob access tiers?
Azure Blob Storage provides access tiers designed for different data-access patterns, including:
- Hot
- Cool
- Cold
- Archive
The appropriate tier depends on how frequently data is accessed and how long it needs to be retained.
14. What is Azure Storage redundancy?
Storage redundancy determines how Azure maintains copies of data for durability and availability.
Common redundancy options include:
- LRS – Locally Redundant Storage
- ZRS – Zone-Redundant Storage
- GRS – Geo-Redundant Storage
- GZRS – Geo-Zone-Redundant Storage
15. What is a Shared Access Signature?
A Shared Access Signature, or SAS, provides delegated and time-limited access to Azure Storage resources. It can restrict access based on permissions, resource scope and validity period.
SAS is useful when an application needs temporary access without exposing long-term storage account credentials.
16. What is Azure Storage lifecycle management?
Lifecycle management allows administrators to automatically move or delete Blob data based on rules and conditions.
For example, older data can be moved from a hot tier to a cooler tier and eventually deleted according to organizational requirements.
17. What is Azure Files?
Azure Files provides managed cloud file shares that can be accessed using common file-sharing protocols. It is useful when applications or users require shared file storage.
18. How can Azure Storage be secured?
- Use Microsoft Entra-based authentication where appropriate.
- Use RBAC for authorization.
- Use SAS for controlled temporary access.
- Protect storage account keys.
- Use encryption.
- Restrict network access.
- Use private endpoints when appropriate.
- Enable appropriate monitoring and logging.
5 Azure Compute Interview Questions
19. What is an Azure Virtual Machine?
An Azure Virtual Machine provides an infrastructure-as-a-service compute environment where administrators can control the operating system, installed software, networking and VM configuration.
20. What are managed disks?
Managed disks are Azure-managed virtual disks used by virtual machines. Azure handles much of the underlying storage management, allowing administrators to focus on disk configuration and VM workloads.
21. What is an availability set?
An availability set is a logical grouping of VMs that helps reduce the risk of simultaneous downtime by distributing VMs across fault and update domains.
22. What are Azure Availability Zones?
Availability Zones are physically separate locations within an Azure region. They provide isolation against certain datacenter-level failures.
Applications can use multiple zones to improve resiliency.
23. What is a Virtual Machine Scale Set?
Azure Virtual Machine Scale Sets allow administrators to deploy and manage a group of load-balanced VMs as a single resource. Scale sets support scaling based on workload requirements.
24. What is Azure App Service?
Azure App Service is a managed platform for hosting web applications, APIs and other supported application workloads without requiring administrators to manage the underlying operating system.
25. What is the difference between a VM and App Service?
A virtual machine provides greater control over the operating system and infrastructure but requires more administration.
App Service is a managed platform where Azure handles much of the underlying infrastructure, allowing developers and administrators to focus more on the application.
26. What are containers in Azure?
Containers package an application together with its dependencies into a portable unit. Azure provides several services for running containerized workloads depending on the application's requirements.
6 Azure Networking Interview Questions
27. What is an Azure Virtual Network?
An Azure Virtual Network, or VNet, provides private networking for Azure resources. It allows resources such as virtual machines to communicate with each other and with other networks.
28. What is a subnet?
A subnet is a logical subdivision of an Azure Virtual Network. Subnets help organize resources and allow network security and routing configurations to be applied to specific portions of a VNet.
29. What is an NSG?
A Network Security Group, or NSG, contains inbound and outbound security rules that control network traffic to and from Azure resources associated with the NSG.
30. What is VNet peering?
VNet peering connects Azure virtual networks so that resources in the connected VNets can communicate using Azure's private networking infrastructure.
31. What is Azure DNS?
Azure DNS provides DNS hosting and name resolution capabilities using Azure's infrastructure. Azure also provides private DNS capabilities for internal name resolution scenarios.
32. What is Azure Load Balancer?
Azure Load Balancer distributes network traffic across backend resources such as virtual machines. It operates at the network transport level and can improve availability and scalability.
33. What is Azure Application Gateway?
Azure Application Gateway is a web traffic load balancer that provides application-layer routing capabilities for web workloads. It supports features such as HTTP/HTTPS traffic routing and TLS termination.
34. What is Azure Bastion?
Azure Bastion provides secure browser-based management access to virtual machines over the Azure portal without requiring public IP addresses on those VMs for management access.
35. How would you troubleshoot a VM that cannot connect to another VM?
I would troubleshoot systematically:
- Check whether both VMs are running.
- Verify the VMs are in reachable networks.
- Check subnet configuration.
- Review NSG inbound and outbound rules.
- Check effective security rules.
- Check route tables and effective routes.
- Check DNS if the connection uses hostnames.
- Use Network Watcher diagnostic tools.
- Check the operating system firewall.
7 Azure Monitoring and Maintenance Questions
36. What is Azure Monitor?
Azure Monitor is Microsoft's monitoring platform for collecting, analyzing and acting on telemetry from Azure resources, applications and other environments.
37. What is Log Analytics?
Log Analytics provides a workspace-based environment for collecting and querying log data. Administrators can use queries to investigate resource activity, performance and operational issues.
38. What is the difference between metrics and logs?
Metrics are numerical measurements collected at regular intervals, such as CPU utilization.
Logs contain more detailed event and diagnostic information that can be queried for troubleshooting and analysis.
39. What are Azure Monitor alerts?
Azure Monitor alerts notify administrators when monitoring data matches defined conditions.
For example, an alert could be configured when VM CPU usage remains above a defined threshold.
40. What is Network Watcher?
Network Watcher provides network monitoring and diagnostic tools for Azure networking resources. It can help administrators diagnose connectivity, routing and security-related issues.
41. What is Azure Backup?
Azure Backup is a managed backup service used to protect supported Azure workloads and other supported data sources. It helps organizations recover data after accidental deletion, corruption or other failures.
42. What is disaster recovery?
Disaster recovery is the process and technology used to restore applications and services after a major failure or disaster.
A good disaster-recovery strategy considers recovery objectives, dependencies, redundancy, backups and testing.
8 Top AZ-104 Scenario-Based Interview Questions
43. A developer needs access to one storage account but not the entire subscription. What would you do?
I would follow the principle of least privilege and assign the appropriate Azure RBAC role at the storage-account scope rather than granting subscription-level access.
This minimizes the developer's permissions while allowing the required task.
44. A company wants all resources to contain an Environment tag. How would you implement this?
I would use Azure Policy to enforce or audit the required tag. The policy could be assigned at an appropriate management group, subscription or resource-group scope.
45. A VM suddenly becomes unreachable. What would you check first?
- VM power state.
- Network interface configuration.
- NSG rules.
- Effective routes.
- Public or private IP configuration.
- DNS configuration if applicable.
- Guest operating system firewall.
- Network Watcher diagnostics.
46. Storage costs are increasing because old data is rarely accessed. What would you recommend?
I would analyze storage usage and access patterns and consider Blob access tiers and lifecycle management rules. Older data could potentially be moved to a more cost-effective tier according to business and retention requirements.
47. An administrator accidentally deleted an important Azure resource. How would you reduce the chance of this happening again?
I would review RBAC permissions, apply appropriate resource locks, use Azure Policy where applicable, improve change-management procedures and ensure important workloads have appropriate backup and recovery mechanisms.
48. Users report that an application is slow. How would you investigate?
I would start with Azure Monitor metrics and application telemetry, then review CPU, memory, network and disk-related indicators. I would inspect logs using Log Analytics and determine whether the issue is caused by the application, compute resources, networking or another dependency.
49. Two VNets need to communicate privately. What Azure feature could you use?
VNet peering can connect the virtual networks and enable private communication between their resources, assuming the required network and security configuration is in place.
50. A company wants administrators to connect to Azure VMs without exposing RDP or SSH directly to the public internet. What would you recommend?
Azure Bastion can provide browser-based management access to supported VMs while reducing the need to expose RDP or SSH management ports through public IP addresses.
9 AZ-104 Rapid-Fire Interview Questions
| Question | Short Answer |
|---|---|
| What is Azure RBAC? | Azure authorization system based on roles and scopes. |
| What is Azure Policy? | Governance service used to enforce or audit organizational rules. |
| What is Entra ID? | Cloud identity and access management service. |
| What is a Resource Group? | Logical container for Azure resources. |
| What is Blob Storage? | Object storage for unstructured data. |
| What is SAS? | Delegated, controlled access to storage resources. |
| What is a VNet? | Private virtual networking environment in Azure. |
| What is an NSG? | Network traffic filtering rules for Azure resources. |
| What is VNet peering? | Private connectivity between Azure virtual networks. |
| What is Azure Monitor? | Platform for monitoring metrics, logs and telemetry. |
| What is Log Analytics? | Workspace-based log collection and query service. |
| What is Network Watcher? | Azure network monitoring and diagnostic service. |
| What is Azure Backup? | Managed backup and recovery service. |
| What is Azure Bastion? | Secure browser-based VM management access. |
10 AZ-104 Topics You Should Know Before an Interview
Identity
Entra ID, users, groups, authentication, RBAC and managed identities.
Governance
Subscriptions, resource groups, Policy, tags, locks and cost management.
Storage
Blob Storage, Files, redundancy, SAS, access keys and lifecycle.
Compute
VMs, disks, availability, scale sets, App Service and containers.
Networking
VNets, subnets, NSGs, routing, DNS, peering and load balancing.
Operations
Monitor, logs, alerts, Network Watcher, backup and recovery.
11 Common AZ-104 Interview Mistakes
- Memorizing definitions without understanding practical scenarios.
- Confusing authentication with authorization.
- Confusing Azure RBAC with Azure Policy.
- Giving subscription-level permissions when resource-level access is sufficient.
- Ignoring NSGs when troubleshooting connectivity.
- Not understanding VNet, subnet and routing relationships.
- Ignoring cost management and governance.
- Forgetting backup and recovery considerations.
- Not checking logs and metrics during troubleshooting.
- Giving answers without explaining the reason behind the recommendation.
12 How to Answer AZ-104 Scenario Questions
Azure Administrator interviews often use scenario-based questions. A strong answer should explain not only what Azure service you would use, but also why you would use it.
- Identify the requirement.
- Choose the Azure service or feature.
- Explain why it fits the requirement.
- Apply least privilege and security principles.
- Explain monitoring or troubleshooting steps.
- Mention cost, availability or scalability when relevant.
13 AZ-104 Practical Administrator Checklist
| Domain | Practical Skills |
|---|---|
| Identity | Create users and groups, assign RBAC roles and manage access. |
| Governance | Create resource groups, apply tags, locks and Azure Policy. |
| Storage | Create storage accounts, containers, file shares and configure access. |
| Compute | Create and manage VMs, disks, availability and scale sets. |
| Networking | Create VNets, subnets, NSGs, routes and peering. |
| Monitoring | Configure metrics, logs, alerts and diagnostic monitoring. |
| Backup | Configure backup and understand restore and recovery scenarios. |
| Troubleshooting | Use Azure Monitor, Log Analytics and Network Watcher. |
14 AZ-104 Interview Preparation Roadmap
☁️ Azure Fundamentals
Understand subscriptions, regions, resource groups, resources, management groups and Azure portal basics.
👤 Identity
Learn Entra ID, users, groups, RBAC, authentication and authorization.
💾 Storage
Practice storage accounts, Blob Storage, Azure Files, redundancy, SAS and lifecycle management.
🖥️ Compute
Practice VMs, disks, availability, VM Scale Sets and App Service.
🌐 Networking
Master VNets, subnets, NSGs, routing, peering, DNS and load balancing.
📊 Operations
Learn Azure Monitor, Log Analytics, alerts, Network Watcher, Backup and recovery.
15 Final AZ-104 Interview Tips
- Practice creating Azure resources yourself.
- Understand RBAC scopes and least privilege.
- Practice configuring VNets and NSGs.
- Understand storage redundancy and access methods.
- Practice VM troubleshooting.
- Learn how Azure Monitor and Log Analytics work.
- Understand backup and recovery concepts.
- Practice scenario-based questions.
- Be ready to explain why you selected a particular Azure service.
🚀 Career Tip for Azure Administrators
The strongest AZ-104 candidates combine certification knowledge with hands-on administration skills. Instead of only memorizing services, practice creating resources, assigning permissions, configuring networking, securing storage, monitoring workloads and troubleshooting real Azure scenarios.
16 Conclusion
Preparing for the AZ-104 Microsoft Azure Administrator interview requires a strong understanding of Azure identity, governance, storage, compute, networking, monitoring and maintenance.
The most important topics include Microsoft Entra ID, Azure RBAC, Azure Policy, Storage Accounts, Blob Storage, Virtual Machines, VNets, NSGs, Azure Load Balancer, Application Gateway, Azure Monitor, Log Analytics, Network Watcher and Azure Backup.
Combine theoretical knowledge with practical Azure labs and scenario-based troubleshooting. This approach will help you answer both technical definition questions and real-world Azure Administrator interview questions.
Learn Azure, Cloud Computing and DevOps with Eduarn
Explore practical Azure, AWS, Cloud Computing, DevOps, Python, Data Science, AI and software-development learning resources designed for students, professionals and IT learners.
AZ-104 Microsoft Azure Administrator Training
Build practical Azure administration skills covering Microsoft Entra ID, RBAC, Azure Policy, storage, virtual machines, networking, Azure Monitor, security, backup and troubleshooting.
Whether you are preparing for the AZ-104 certification, applying for an Azure Administrator position or building your cloud career, hands-on Azure knowledge can help you develop practical cloud administration skills.
Learn with Eduarn
Explore Eduarn's learning resources covering Azure, AWS, cloud computing, DevOps, software development, Python, Data Science, AI, cybersecurity and modern technology.
About Eduarn
Eduarn is a learning and training platform focused on helping learners develop practical skills in cloud computing, AWS, Microsoft Azure, software development, data engineering, DevOps, cybersecurity, AI, Python, Data Science and professional technology skills. Eduarn aims to make technical learning accessible through structured courses, tutorials, certification preparation, practical guidance and career-oriented technology resources.
Microsoft Azure • AZ-104 • Azure Administrator • Microsoft Entra ID • Azure RBAC • Azure Storage • Azure Virtual Machines • Azure VNet • Azure Networking • Azure Monitor • Azure Backup • Cloud Computing • DevOps
🚀 Start Your Azure Administrator Journey
Learn Azure fundamentals → Master AZ-104 topics → Practice Azure labs → Build troubleshooting skills → Prepare for interviews → Grow your cloud career.
Azure Skills → AZ-104 → Hands-On Labs → Azure Administrator → Cloud Career
Prepare for the AZ-104 Microsoft Azure Administrator certification and Azure administration interviews with this comprehensive collection of interview questions and answers. Learn key concepts across Microsoft Entra ID, RBAC, Azure Policy, storage accounts, virtual machines, networking, monitoring, backup, governance and cost management with practical Azure-focused explanations.
ReplyDelete