Skip to main content
AnyCert logo
Microsoft - AZ-104

The fastest way to pass AZ-104.

AI finds your gaps, picks your next session, and drills only those. No syllabus to decode.

We refund every penny if you do not pass.

15-minute diagnostic
2Weak-theme drills
3Question-aware tutor
4Readiness simulator
See pricing and plans

209

Practice questions

5

AZ-104 domains

60

Real exam questions

May 2026

Last reviewed

AZ-104 · 60 questions · 120 min · passing score 700/1000

The real reason candidates miss AZ-104

It is not the role assignment. It is the inheritance path.

AZ-104 access questions are full of answers that all sound like RBAC. The exam tests whether the assignment actually reaches the resource through scope and group membership. AnyCert trains that path logic.

AZ-104 admin scenarioCorrect answer marked

You run 'Access control (IAM) -> View effective access' for a user on a storage account. It shows no access even though the user is in a group with Storage Blob Data Reader assigned at subscription scope. What should you check first?

A.

Check whether the storage account is in a different subscription or management group where the group assignment does not apply to this resource.

Scope can break inheritance, but the faster first check is whether the user is truly resolving as a member of the assigned group.

B.

Confirm that the group membership sync or nested group membership resolution is working and that the user is actually an effective member of the assigned group.

If effective membership fails, the user never inherits the subscription assignment in the first place.

C.

Recreate the role assignment at the resource group level because View effective access does not evaluate subscription assignments.

This sounds practical, but it is false. Effective access does evaluate inherited subscription assignments.

D.

Disable all other role assignments for the user because the effective access tool only shows the single highest-priority assignment.

There is no single highest-priority assignment rule here. This is a made-up mechanism designed to sound portal-specific.

The pattern

AZ-104 loves access questions where the role looks right and the path is wrong. The bank drills scope, inheritance, and membership resolution until you stop trusting the first obvious assignment.

Sample questions

See the question bank in context.

Every answer review is built to explain the correct choice, the trap answer, and the next study move.

Manage Azure identities and governanceCorrect: B

A user was granted Reader role on a resource group but still cannot access a specific resource inside it. What is the most likely reason?

A. Role assignments at the resource group level do not apply to child resources, so the user will never inherit those permissions.

B. A deny assignment or a more restrictive role at the resource level is preventing the inherited Reader permissions from applying to that specific resource.

C. The Reader role only applies to management group scope and not to resource groups or individual resources.

D. Azure RBAC evaluates only the highest privilege assignment, so a Reader assignment is ignored if any other assignment exists at any scope.

A deny assignment or a narrower role at resource scope can block inherited permissions; inheritance normally applies but can be overridden by denies or explicit assignments.

Implement and manage storageCorrect: A

An application needs to write messages to an Azure Queue with the least privilege. Which authentication approach and scope should you use?

A managed identity with the Storage Queue Data Contributor role scoped narrowly gives least privilege for queue writes; SAS with full account rights or Owner role is excessive, and service principals shouldn't use account keys.

Deploy and manage Azure compute resourcesCorrect: A

A team wants minimal Azure subnet IP consumption to maximize pods per subnet while accepting some NAT limitations; which model fits and what limitation should they accept?

Kubenet reduces subnet IP usage via NAT but sacrifices pod VNet routability; Azure CNI consumes subnet IPs and doesn't avoid the tradeoffs described.

Full access

Less than one AZ-104 retake.

The AZ-104 exam is ${examCost}. AnyCert annual is {yearlyPrice} - and if you do not pass, every penny back.

100% money back if you do not pass. Cancel anytime. No card to start.

Try it first

Free

$0

Use the readiness diagnostic and sample questions before you commit.

Most flexible

Monthly

$29.99

Best when you need active prep without a long commitment.

Save 44%

Annual

Best value

$199.99

Lowest effective cost, full access, and the strongest value if you want margin.

What you get

Free

Monthly

Annual

Diagnostic readiness score
Yes
Yes
Yes
Sample questions
5
All
All
209 practice questions
-
Yes
Yes
Trick-wording training
Preview
Yes
Yes
Full-length exam simulator
-
Yes
Yes
Score curve history
-
30 days
Unlimited
Readiness dashboard by theme
-
Yes
Yes
AI tutor in-context
-
Yes
Yes
Exam-date plan builder
-
Yes
Yes
100% money-back guarantee
-
Yes
Yes
Invoicing / PO / team seats
-
-
On request

Your plan

Map the work to your exam date.

Most AZ-104 prep turns into portal wandering. AnyCert compresses it into a focused 3-4 week path and keeps the next session obvious.

We’ll route you into a plan sized to the days you actually have — 7-day urgent, 14-day standard, or 4+ weeks.

7 days

Urgent
Total hours
14-18 hours
Daily
2-3 hrs/day
Shape
Diagnostic -> drill weak themes -> 2 simulators -> 48-hour review

Compressed: works if you already know the subject and need exam-format training

14 days

Standard
Total hours
15-20 hours
Daily
~1 hr/day
Shape
Diagnostic -> full theme coverage -> simulators -> targeted review

4+ weeks

Deep prep
Total hours
20-30 hours
Daily
~45 min/day
Shape
Slower intake -> clarifying tutor sessions -> spaced simulators -> calm final week

AI tutor

Ask why while the question is still fresh.

The tutor keeps the current question, your answer, and the correct explanation in view so follow-up questions stay grounded.

  • Question-aware. It answers from the question you just reviewed.
  • Momentum-safe. You can ask the next question without leaving practice.
  • Exam-oriented. It explains the reasoning pattern, not just the fact.

Question 27 - Manage Azure identities and governance

A subscription-level Storage Blob Data Reader assignment exists, but effective access still shows none. What should you check first?

Your answer: Recreate the assignment at resource group scope.

Correct: Confirm effective membership in the assigned group.

Why not just recreate the role assignment lower in the tree and move on?

Because the question is asking what to check first, not how to work around it. If the user is not resolving as a member of the assigned group, the inherited access will never appear no matter how correct the role is.

What is the fast mental model for AZ-104 RBAC questions?

Read the path in order: principal, membership, assignment scope, resource. If one link breaks, the access breaks.

Content trust

Aligned to AZ-104. Built for day-to-day Azure admin calls.

AZ-104 is an operations exam. It rewards administrators who can trace the control path cleanly. Here is what is in the bank.

Mapped to all 5 AZ-104 domains

Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Configure and manage virtual networking, and Monitor and back up Azure resources.

60-question, 120-minute exam shape

You train the exact admin decisions AZ-104 asks: RBAC inheritance, storage controls, VM operations, networking, monitoring, and backup choices.

209 current practice questions

You get 209 AZ-104 questions across Entra ID, storage, compute, networking, and backup - all in one focused path.

Why-right / why-wrong explanations

Every explanation names which link in the Azure control path actually broke: scope, membership, policy, networking, or resource configuration.

For teams

Azure operations team, MSP cohort, or internal admin bench preparing together? Invoiced billing, seat management, and SSO on request - same refund per seat.

Email teams@anycert.co

Frequently asked questions

The five questions candidates actually ask before buying AZ-104 prep.

Email us. We refund every penny. No store credit. No argument. Finish the program and fail, and you get your money back.

Start Session 0 in 5 minutes. No card required.

100% money back if you do not pass.

Get plan