AZ-104 Reference

--- image: https://images.credly.com/size/110x110/images/336eebfc-0ac3-4553-9a67-b402f491f185/azure-administrator-associate-600x600.png tags: AZ-104, Reference GA: G-DXYJBX6BH8 --- # AZ-104 Reference :::success Date: 20260915 Course ID: 107449 ::: :::info Post Course Survey: [https://aka.ms/az104zhsurvey](https://aka.ms/az104zhsurvey) ::: ## Course Materials [Course AZ-104 English version](https://learn.microsoft.com/en-us/training/courses/az-104t00) [Course AZ-104 简体中文版本](https://learn.microsoft.com/zh-cn/training/courses/az-104t00) [Course AZ-104 正體中文版本](https://learn.microsoft.com/zh-tw/training/courses/az-104t00) ## Infos [ESI Support](https://aka.ms/esisupport) [Azure Pricing Calculator](https://azure.microsoft.com/en-us/pricing/calculator/) [Azure Architecture Center](https://learn.microsoft.com/en-us/azure/architecture/) ## Lab ### Skillable lab system [ESI Labs](https://aka.ms/esilab) :::success Training key: 96DD1C94D54D0976 ::: :::info Only need to redeem once Valid for 6 months ::: ### Instruction [AZ-104 Labs EN](https://aka.ms/AZ104Labs) [AZ-104 Lab files](https://aka.ms/az104labfiles)  ## Course Info ![Course](https://mdcontent.yu.money/contents/31b5b0d6ee886b9be732c5f12.PNG) ![Certification Areas](https://mdcontent.yu.money/contents/n1mzaqlliyggc10aj8mwgxys0.png) ## M01 - Microsoft Entra ID [Active Directory Domain Services Overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) [Compare Active Directory to Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/compare) [What is Microsoft Entra? ](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra) [Microsoft Entra External ID](https://learn.microsoft.com/en-us/entra/external-id/external-identities-overview) [Microsoft Entra Verified ID](https://learn.microsoft.com/en-us/entra/verified-id/decentralized-identifier-overview) [Microsoft Entra ID terminology](https://learn.microsoft.com/en-us/entra/identity-platform/developer-glossary) [Microsoft Entra ID Role](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference) [Microsoft Entra ID Custom Role](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-overview) [Application and service principal objects in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals) [Microsoft Entra ID Domain Service](https://learn.microsoft.com/en-us/entra/identity/domain-services/overview) [Compare self-managed Active Directory Domain Services, Microsoft Entra ID, and managed Microsoft Entra Domain Services](https://learn.microsoft.com/en-us/entra/identity/domain-services/compare-identity-solutions) [Microsoft Entra ID Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview) [Microsoft Entra ID comparison based on licenses](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing#feature-comparison-based-on-licenses) [Zero Turst Security](https://www.microsoft.com/en-us/security/business/zero-trust) [Administrative units in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units) [Microsoft Entra data retention](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention) [Microsoft Entra ID joined devices](https://learn.microsoft.com/en-us/entra/identity/devices/concept-directory-join) [Microsoft Entra ID Connect and Microsoft Entra ID Connect Health installation roadmap](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-roadmap) [Microsoft Entra ID Connect: Staging server and disaster recovery](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-staging-server) [Topologies for Microsoft Entra Connect](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-topologies) [Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra ID self-service password reset](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr) ## M02 - Compliance ### Azure Infrastructure [Azure Speed Test 2.0](https://richorama.github.io/AzureSpeedTest2/) [Azure Products by Region](https://azure.microsoft.com/en-us/explore/global-infrastructure/products-by-region/table) [What are Azure availability zones?](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview) [Azure regions with availability zones support](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-service-support) [Azure region pairs and nonpaired regions](https://learn.microsoft.com/en-us/azure/reliability/regions-paired) [List of Azure regions](https://learn.microsoft.com/en-us/azure/reliability/regions-list) ### Cost Management [Azure Offer](https://azure.microsoft.com/en-us/support/legal/offer-details/) [Azure Hybrid Benefit](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/hybrid-use-benefit-licensing) [Azure Reservations](https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/save-compute-costs-reservations) [Azure Savings Plans](https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/savings-plan-overview) [FinOps on Azure](https://learn.microsoft.com/en-us/cloud-computing/finops/) [Create and manage Azure budgets](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets) [Azure Advisor overview](https://learn.microsoft.com/en-us/azure/advisor/advisor-overview) ### Monitoring & Activity [Azure Activity Log](https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log) ### Governance [Azure management groups](https://learn.microsoft.com/en-us/azure/governance/management-groups/overview) [Management group design recommendations](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) [Cloud Adoption Framework - Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/govern/) [Lock resources to prevent unexpected changes](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources) [Apply tags to organize Azure resources](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources) ### Azure Policy [What is Azure Policy? ](https://learn.microsoft.com/en-us/azure/governance/policy/overview) [Microsoft Cloud Security Benchmark (MCSB)](https://learn.microsoft.com/en-us/security/benchmark/azure/overview) [Regulatory compliance in Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/regulatory-compliance) [Azure Policy definition structure](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-basics) [Azure Policy initiative definition structure](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure) [Recommended policies for Azure services](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/recommended-policies) [Tutorial: Create a custom policy definition](https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-custom-policy-definition) [Azure Policy built-in policy definitions](https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies) [Details of the ISO 27001:2013 Regulatory Compliance built-in initiative](https://learn.microsoft.com/en-us/azure/governance/policy/samples/iso-27001) ### RBAC [Understand Azure role definitions](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions) [List Azure role definitions](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list) [Azure built-in roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles) [RBAC Role Changes Tracker](https://rbac-catalog.dev/) [Azure custom roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles) [Tutorial: Create or update Azure custom roles using the Azure portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal) [Built-in policy definitions for Azure RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/policy-reference) ## M03 - Administration ### Azure Portal [Azure Portal](https://portal.azure.com/) ### Azure Cloud Shell [Features & tools for Azure Cloud Shell](https://learn.microsoft.com/en-us/azure/cloud-shell/features) ### Azure CLI & PowerShell [Install Azure PowerShell](https://learn.microsoft.com/en-us/powershell/azure/install-az-ps) [Get started with Azure PowerShell](https://learn.microsoft.com/en-us/powershell/azure/get-started-azureps) [Azure PowerShell documentation](https://learn.microsoft.com/en-us/powershell/azure/) [Install Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) [Get started with Azure CLI](https://learn.microsoft.com/en-us/cli/azure/get-started-with-azure-cli) [Azure CLI documentation](https://learn.microsoft.com/en-us/cli/azure/) ### Azure Resource Manager (ARM) [Azure Resource Manager overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview) [ARM template overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) [ARM template best practices](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/best-practices) [ARM template functions](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions) [ARM template user-defined functions](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/user-defined-functions) [Azure Quickstart Templates](https://github.com/Azure/azure-quickstart-templates) ### Azure Bicep [Azure Bicep overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview) [Bicep best practices](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/best-practices) [Bicep file structure and syntax](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/file) [Bicep modules](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/modules) [Decompiling ARM template JSON to Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/decompile?tabs=azure-cli) [Comparing JSON and Bicep for templates](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/compare-template-syntax) [Azure Bicep playground](https://azure.github.io/bicep/) ### Deployment Validation [ARM template what-if deployment](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if) [Bicep what-if deployment](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if) [ARM template test toolkit (arm-ttk)](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/test-toolkit) ### Template Management [Azure Template Specs overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-specs) [Create and deploy template specs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-specs-create-linked) [Azure deployment stacks overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks) [Create and deploy deployment stacks](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks?tabs=azure-cli) ## M04 - Virtual Network ### Basic Networking [What is Azure Virtual Network?](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview) [Azure Virtual Network concepts and best practices](https://learn.microsoft.com/en-us/azure/virtual-network/concepts-and-best-practices) [Plan virtual networks](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm) [Virtual Network FAQ](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq) [Virtual Network business continuity](https://learn.microsoft.com/en-us/azure/reliability/reliability-virtual-network) [Azure Networking limits](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-resource-manager-virtual-networking-limits) ### IP Addressing [Public IP addresses](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses) [Private IP addresses](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/private-ip-addresses) [IPv6 for Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview) [Reserved IP addresses in subnets](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#are-there-any-restrictions-on-using-ip-addresses-within-these-subnets) [What is IP address 168.63.129.16?](https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16) ### Routing [Virtual network traffic routing (UDR / route tables)](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview) ### DDoS Protection [Azure DDoS Protection overview](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview) [Azure DDoS Protection SKU comparison](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-sku-comparison) [DDoS Protection best practices](https://learn.microsoft.com/en-us/azure/ddos-protection/fundamental-best-practices) ### Network Security Group [Network security groups overview](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) [Security rules](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#security-rules) [Default security rules](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#default-security-rules) [Augmented security rules](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#augmented-security-rules) [Service tags overview](https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview) [Application security groups](https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups) [NSG flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview) ### Firewall [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) [Azure Firewall features by SKU](https://learn.microsoft.com/en-us/azure/firewall/features-by-sku) [Azure Firewall Premium features](https://learn.microsoft.com/en-us/azure/firewall/premium-features) [Azure Firewall pricing](https://azure.microsoft.com/en-us/pricing/details/azure-firewall/) [Deploy and configure Azure Firewall using Azure portal](https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal-policy) [Azure Firewall FAQ (NSG vs Azure Firewall)](https://learn.microsoft.com/en-us/azure/firewall/firewall-faq) ### Azure Network Security [Azure DDoS Protection overview](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview) [Azure DDoS Protection SKU comparison](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-sku-comparison) [Network security groups - augmented security rules](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#augmented-security-rules) [Azure Virtual Network Manager](https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview) [Azure Route Server](https://learn.microsoft.com/en-us/azure/route-server/overview) ### Azure DNS Zone [What is Azure DNS?](https://learn.microsoft.com/en-us/azure/dns/dns-overview) [Azure DNS FAQ](https://learn.microsoft.com/en-us/azure/dns/dns-faq) [Delegate Azure DNS subdomains](https://learn.microsoft.com/en-us/azure/dns/dns-domain-delegation) [Host reverse DNS lookup zones](https://learn.microsoft.com/en-us/azure/dns/dns-reverse-dns-overview) [Azure DNS Private Resolver](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) ### Private DNS [What is Azure Private DNS?](https://learn.microsoft.com/en-us/azure/dns/private-dns-overview) [Azure Private DNS zones](https://learn.microsoft.com/en-us/azure/dns/private-dns-privatednszone) [Private DNS zone virtual network links](https://learn.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links) [Private DNS zone auto registration](https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration) [Private DNS scenarios](https://learn.microsoft.com/en-us/azure/dns/private-dns-scenarios) ### DNS Private Resolver [What is Azure DNS Private Resolver?](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) [Private Resolver architecture](https://learn.microsoft.com/en-us/azure/dns/private-resolver-architecture) [Resolve Azure and on-premises domains](https://learn.microsoft.com/en-us/azure/dns/private-resolver-hybrid-dns) [DNS Private Resolver endpoints and rulesets](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) ## M05 - Intersite Connectivity ### Peering [Virtual network peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview) [Create, change, or delete a virtual network peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering) [Virtual network peering FAQ](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#virtual-network-peering) [Configure VPN gateway transit for virtual network peering](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit) [Choose between virtual network peering and VPN gateways](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/virtual-network-peering) ### Service Chaining (UDR + NVA) [VNet peering service chaining](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service-chaining) [User-defined routes](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview) [Enable or disable IP forwarding for a network interface](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding) ### Virtual network Gateway (VPN Gateway) [VPN Gateway SKUs](https://learn.microsoft.com/en-us/azure/vpn-gateway/about-gateway-skus) [VPN Gateway SKU migration guidance](https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation) [VPN Gateway High availability](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable) #### VPN Gateway Implementation [Create Site-to-Site VPN](https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal) [Configure Point-to-Site VPN with certificate authentication](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-certificate-gateway) [Configure Point-to-Site VPN with Azure AD authentication](https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant) [VPN Gateway high availability scenarios](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable) ### ExpressRoute [ExpressRoute](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-introduction) [ExpressRoute FAQ](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-faqs) [Microsoft 365 Routing with ExpressRoute](https://learn.microsoft.com/en-us/microsoft-365/enterprise/azure-expressroute?view=o365-worldwide) [ExpressRoute Pricing](https://azure.microsoft.com/en-us/pricing/details/expressroute/) ### Hub-Spoke Architecture [Hub-spoke network topology in Azure](https://learn.microsoft.com/en-us/azure/architecture/networking/architecture/hub-spoke) [Hub-spoke topology with Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/architecture/networking/architecture/hub-spoke-virtual-wan-architecture) ### Virtual WAN [Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about) [Virtual WAN FAQ](https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-faq) [Upgrade a virtual WAN from Basic to Standard (SKU Comparsion)](https://learn.microsoft.com/en-us/azure/virtual-wan/upgrade-virtual-wan) [Scenario: Custom Isolation for Virtual Networks and Branches](https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing) ## M06 - Network Traffic Management ### Secure Connection to PaaS [Azure Service Endpoint](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview) [Azure Private Link](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview) [What is the difference between Service Endpoints and Private Endpoints?](https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#what-is-the-difference-between-service-endpoints-and-private-endpoints-) [Difference between Azure Private Links and Azure Service Endpoints](https://medium.com/awesome-azure/azure-difference-between-azure-private-links-and-azure-service-endpoints-private-links-vs-service-endpoints-8fb0f80ca196) ### Traffic Management [Load balancing overview](https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview) [Azure Load Balancer SKU](https://learn.microsoft.com/en-us/azure/load-balancer/skus) [Distribution mode for Azure Load Balancer](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode) [Cross Region Load Balancer](https://learn.microsoft.com/en-us/azure/load-balancer/cross-region-overview) [Application Gateway Tier Compare](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-autoscaling-zone-redundant) [Application Gateway URL path-based routing](https://learn.microsoft.com/en-us/azure/application-gateway/url-route-overview) [Application Gateway backend settings](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings) [Application Gateway health probes](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-probe-overview) [Application Gateway redirects](https://learn.microsoft.com/en-us/azure/application-gateway/redirect-overview) [Traffic Manager Routing](https://learn.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods) [What is Azure Front Door?](https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview) [What is Azure Network Watcher?](https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview) [Monitor network communication with Connection Monitor](https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview) [Virtual network flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview) [Packet capture overview](https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-overview) ## M07 - Storage [Azure Blob Storage Types](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview#types-of-storage-accounts) [Azure Storage Explorer](https://azure.microsoft.com/en-us/products/storage/storage-explorer/) [Business continuity and disaster recovery](https://learn.microsoft.com/en-us/azure/reliability/regions-paired) [Enable and create large file shares](https://learn.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share) [Storage Tier](https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview?tabs=azure-portal) [Lifecycle management](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview) [Lifecycle management - Move data based on last accessed time](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview#move-data-based-on-last-accessed-time) [Azure Files storage tiers](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-planning#storage-tiers) [Understanding block blobs, append blobs, and page blobs](https://learn.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-page-blobs) [Copy data from S3 to Azure Storage](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-s3) [Access to blobs and queues using Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory) [Azure File scalability and performance targets](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets) [Object replication for block blobs](https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-overview) [Azure Storage redundancy](https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy) [Azure Storage Limitation](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-storage-limits) [Deploy Azure File Sync](https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide) [Azure 存儲的授權方式](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage) [Prevent Shared Key authorization for an Azure Storage account](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent) ### Storage Security [Grant limited access with shared access signatures (SAS)](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) [Define a stored access policy](https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy) ### Advanced Storage Features [Soft delete for blob containers (考试重点)](https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-container-overview) [Soft delete for blobs](https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview) [Azure Files premium tier SMB Multichannel](https://learn.microsoft.com/en-us/azure/storage/files/smb-performance) [Azure Blob Storage lifecycle management policies](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure) [Immutable storage for blob data](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview) [Blob versioning](https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview) [Share snapshots for Azure Files](https://learn.microsoft.com/en-us/azure/storage/files/storage-snapshots-files) [Copy or move data with AzCopy](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10) ## M08 - VM ### Azure VM [VM Size](https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/overview) [Availability options](https://learn.microsoft.com/en-us/azure/virtual-machines/availability) [VM's SLA](https://azure.microsoft.com/en-us/support/legal/sla/virtual-machines/) [Azure SPOT VM](https://learn.microsoft.com/en-us/azure/virtual-machines/spot-vms) [Introduction to Azure managed disks](https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview) [Azure managed disk types](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-types) [FAQs for Azure Disks](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/azure-iaas-vm-disks-managed-unmanaged) [FAQs for Azure IaaS VM disks and managed and unmanaged premium disks](https://learn.microsoft.com/en-us/azure/virtual-machines/faq-for-disks) [How to expand virtual hard disks attached to a Windows virtual machine](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/expand-disks) [Azure Disk Encryption overview](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview) [Enable end-to-end encryption using encryption at host](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal) [Azure virtual machine extensions and features](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/overview) [Azure VM Image Builder overview](https://learn.microsoft.com/en-us/azure/virtual-machines/image-builder-overview?tabs=azure-powershell) [Default outbound access in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access) [Assessment overview (migrate to Azure VMs)](https://learn.microsoft.com/en-us/azure/migrate/concepts-assessment-calculation?view=migrate-classic) #### Modern VM Features [Azure Trusted Launch for VMs](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch) [Azure Confidential Computing](https://learn.microsoft.com/en-us/azure/confidential-computing/overview) [Ephemeral OS disks](https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks) [Azure VM Image Builder (latest version)](https://learn.microsoft.com/en-us/azure/virtual-machines/image-builder-overview) [Automatic VM guest patching](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching) ### VMSS [VM scale sets](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview) [Orchestration modes for Virtual Machine Scale Sets in Azure](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes) [Considerations for scaling when multiple profiles are configured in an autoscale setting](https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-understanding-settings#how-does-autoscale-evaluate-multiple-rules) ### Azure Bastion [What is Azure Bastion?](https://learn.microsoft.com/en-us/azure/bastion/bastion-overview) [Design architecture for Azure Bastion](https://learn.microsoft.com/en-us/azure/bastion/design-architecture) [About Bastion configuration settings](https://learn.microsoft.com/en-us/azure/bastion/configuration-settings) [About Bastion VM connections and features](https://learn.microsoft.com/en-us/azure/bastion/vm-about) ### Others [Custom Script Extension for Windows](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows) [Custom Script Extension for Linux](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux) [Desired State Configuration for Windows](https://learn.microsoft.com/en-us/powershell/scripting/dsc/getting-started/wingettingstarted?view=powershell-7.1) [Create Windows VM images with Azure PowerShell](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-custom-images) ## M09 - Platform Service Computing ### Azure App Service [App Service plans](https://azure.microsoft.com/en-us/pricing/details/app-service/windows/) [Local Git deployment to Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/deploy-local-git) [App Service managed certificate](https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex#create-a-free-managed-certificate) [Map an existing custom DNS name to App Service](https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain) [Secure a custom DNS name with a TLS/SSL binding](https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-bindings) [Frontdoor](https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview) [Hybrid Connection](https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections) [Back up and restore your app in App Service](https://learn.microsoft.com/en-us/azure/app-service/manage-backup) [Scaling](https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up) [Deployment Slots](https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots?tabs=portal) [App Service Local Cache](https://learn.microsoft.com/en-us/azure/app-service/overview-local-cache) [Set up staging environments in Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots) > `https://blog.amitapple.com/post/2014/11/azure-websites-slots/#.WH-1CeTrtWw` [Azure Web App with Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-net-create-vault-azure-web-app) [Azure Web App sandbox](https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox) [Inside the Azure App Service Architecture](https://learn.microsoft.com/en-us/archive/msdn-magazine/2017/february/azure-inside-the-azure-app-service-architecture) ### Container [Azure Container Registry service tiers](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-skus) [Push container image to ACR](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-tutorial-prepare-acr) [Make Azure container registry content publicly available](https://learn.microsoft.com/en-us/azure/container-registry/anonymous-pull-access) [Deploy docker image locally](https://code.visualstudio.com/docs/containers/quickstart-aspnet-core) [Containers on Azure](https://azure.microsoft.com/en-us/products/category/containers) [ACI with CLI quickstart](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-quickstart) [ACI using Docker Compose](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-multi-container-group) [Container groups in Azure Container Instances](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups) ### Azure Container Apps [Azure Container Apps overview](https://learn.microsoft.com/en-us/azure/container-apps/overview) [Azure Container Apps environments](https://learn.microsoft.com/en-us/azure/container-apps/environment) [Comparing Container Apps with other Azure container options](https://learn.microsoft.com/en-us/azure/container-apps/compare-options) [Set up HTTPS ingress in Azure Container Apps](https://learn.microsoft.com/en-us/azure/container-apps/ingress-overview) [Scaling in Azure Container Apps](https://learn.microsoft.com/en-us/azure/container-apps/scale-app) [Microservices with Azure Container Apps](https://learn.microsoft.com/en-us/azure/container-apps/microservices) [Dapr integration with Azure Container Apps](https://learn.microsoft.com/en-us/azure/container-apps/dapr-overview) [Deploy to Azure Container Apps using GitHub Actions](https://learn.microsoft.com/en-us/azure/container-apps/github-actions) [Choose an Azure container service (ACA vs AKS decision guide)](https://learn.microsoft.com/en-us/azure/architecture/guide/choose-azure-container-service) ### Azure Kubernets Service [Kubernetes core concepts for Azure Kubernetes Service](https://learn.microsoft.com/en-us/azure/aks/core-aks-concepts) [Deploy an AKS using the Azure CLI](https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-cli) [Scale applications in AKS](https://learn.microsoft.com/en-us/azure/aks/tutorial-kubernetes-scale) [Storage options for applications in AKS](https://learn.microsoft.com/en-us/azure/aks/concepts-storage) [Authenticate with Azure Container Registry from Azure Kubernetes Service](https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli) [Create and configure an Azure Kubernetes Services (AKS) cluster to use virtual nodes](https://learn.microsoft.com/en-us/azure/aks/virtual-nodes) [virtual-kubelet](https://github.com/virtual-kubelet/virtual-kubelet) [Kubenet and Azure CNI](https://learn.microsoft.com/en-us/azure/aks/configure-kubenet) [Simplified application autoscaling with Kubernetes Event-driven Autoscaling (KEDA) add-on (Preview)](https://learn.microsoft.com/en-us/azure/aks/keda-about) ## M10 - Backup ### Azure Backup [What is the Azure Backup service?](https://learn.microsoft.com/en-us/azure/backup/backup-overview) [Overview of Archive tier in Azure Backup](https://learn.microsoft.com/en-us/azure/backup/archive-tier-support) [Overview of Backup center](https://learn.microsoft.com/en-gb/azure/backup/backup-center-overview) [Backup vaults overview](https://learn.microsoft.com/en-us/azure/backup/backup-vault-overview) [Recovery Services vaults overview](https://learn.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview) [Create and configure a Recovery Services vault](https://learn.microsoft.com/en-us/azure/backup/backup-create-recovery-services-vault) [Azure Backup MARS agent](https://learn.microsoft.com/en-us/azure/backup/install-mars-agent) [Back up Windows Server files and folders to Azure](https://learn.microsoft.com/en-us/azure/backup/backup-windows-with-mars-agent#install-and-register-the-agent) [Install and upgrade Azure Backup Server](https://learn.microsoft.com/en-us/azure/backup/backup-azure-microsoft-azure-backup) [Immutable vault for Azure Backup](https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault-concept?tabs=recovery-services-vault#restricted-operations) ### Site Recovery [About Site Recovery](https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-overview) [General questions about Azure Site Recovery](https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-faq) [Quickstart: Set up disaster recovery to a secondary Azure region for an Azure VM](https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-quickstart) ### Enhanced Protection Features [Azure Backup support for Azure Kubernetes Service](https://learn.microsoft.com/en-us/azure/backup/azure-kubernetes-service-backup-overview) [Multi-user authorization for Azure Backup](https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization-concept) [Azure Backup Metrics and Monitoring](https://learn.microsoft.com/en-us/azure/backup/metrics-overview) ## M11 - Monitor ### Azure Monitor [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/overview) [Azure Monitor alerts overview](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview) [What is Azure Network Watcher?](https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview) [Monitor network communication with Connection Monitor](https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview) [Monitoring your storage service with Azure Monitor Storage insights](https://learn.microsoft.com/en-us/azure/storage/common/storage-insights-overview) [Metrics experience for virtual machines in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/vm/metrics-opentelemetry-guest) [Enable VM monitoring in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vm-enable-monitoring) [VM Insights Map and Dependency Agent retirement guidance](https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-maps-retirement) [Azure Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/data-explorer-overview) [Configure PV(persistent volumes) monitoring with Container insights](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-persistent-volumes) [Azure Monitor REST API](https://learn.microsoft.com/en-us/rest/api/monitor/) [Azure Monitor Videos (YouTube)](https://www.youtube.com/playlist?list=PLLasX02E8BPCCsHzNLJjcElCwF52rnh6t) [What is Azure Managed Grafana?](https://learn.microsoft.com/en-us/azure/managed-grafana/overview) [Azure Monitor managed service for Prometheus](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-metrics-overview)  ### Log Analytics [Log Analytics demo environment](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade) [Log Analytics tutorial](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial) [Kusto Query Language (KQL) overview](https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true) [Tutorial: Use Kusto queries](https://learn.microsoft.com/en-us/kusto/query/tutorials/learn-common-operators?view=azure-data-explorer&preserve-view=true&pivots=azuremonitor) [Kusto Function types](https://learn.microsoft.com/en-us/kusto/query/functions/?view=azure-data-explorer&preserve-view=true) [Run search jobs in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/search-jobs) ### Modern Observability Stack [Azure Monitor OpenTelemetry overview](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview#getting-started) [Azure Monitor workspace (for Prometheus)](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/azure-monitor-workspace-overview) [Container insights (AKS/Container Apps monitoring)](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-monitoring-overview) [Azure Workbooks](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview) ## Mind Map ```markmap # AZ-104 · Microsoft Azure Administrator ## M01 - Microsoft Entra ID ### Directory foundations - [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra): cloud identity and access management for users, groups, applications, and devices - [Microsoft Entra ID vs Active Directory DS](https://learn.microsoft.com/en-us/entra/fundamentals/compare): cloud identity service vs traditional domain services - Microsoft Entra ID is also the directory used by cloud applications and Microsoft online services - P1/P2 licensing adds identity capabilities; [Microsoft Entra Domain Services](https://learn.microsoft.com/en-us/entra/identity/domain-services/overview) provides managed domain features ### Manage identities - Create and manage users and groups, restore deleted users, and assign licenses - Register devices and use group membership to organize access and administration - Custom security attributes add business-specific metadata; automatic provisioning creates and updates identities from connected systems ### Self-service password reset - [SSPR](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr) lets users reset passwords or unlock accounts without help-desk intervention - Define scope, authentication methods, registration, notifications, and customization - Evaluate the requirements, deploy the configuration, and test the user experience ## M02 - Compliance ### Azure architecture and hierarchy - Datacenters form regions; [availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview) provide separate datacenter locations within supported regions - Region pairs and sovereign regions address geographic, regulatory, and continuity requirements - [Management group](https://learn.microsoft.com/en-us/azure/governance/management-groups/overview) → subscription → resource group → resource defines the management hierarchy ### Azure Policy - [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) enforces organizational standards and evaluates compliance at scale - Definition → initiative → assignment → compliance evaluation - Policy effects determine whether a resource is audited, denied, modified, or remediated ### Azure RBAC - Role assignment = security principal + role definition + scope - [Built-in roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles) grant common permissions; access checks show the assignments effective at a scope - Verify current access → grant the required role at the narrowest scope → review RBAC changes in the Activity Log ## M03 - Administration ### Azure Cloud Shell - [Cloud Shell](https://learn.microsoft.com/en-us/azure/cloud-shell/features) provides an authenticated, browser-based shell for Azure administration - Choose Bash with Azure CLI or PowerShell with Azure PowerShell according to the task and scripting preference - Persistent storage keeps scripts and files available across Cloud Shell sessions ### JSON ARM templates - ARM templates declare Azure resources in JSON for repeatable deployments - Template structure includes schema, content version, parameters, variables, resources, and outputs - Create the template in Visual Studio Code → define resources and parameters → deploy → use outputs ## M04 - Virtual Network ### Virtual networks and IP addressing - [Virtual networks and subnets](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview) create private network boundaries for Azure resources - Plan non-overlapping address spaces and choose subnet sizes for workload and growth requirements - Public IP addresses support internet-facing resources; private IP addresses provide communication within private networks - Azure reserves the first four and last IP address in every subnet ### Network security groups - [NSG rules](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) evaluate source, destination, port, protocol, direction, priority, and action - Effective security rules combine the NSGs applied to a network interface and its subnet - Application security groups represent workload roles; service tags represent Azure service address ranges ### Azure DNS - [Azure DNS](https://learn.microsoft.com/en-us/azure/dns/dns-overview) hosts DNS zones and records after a domain is delegated - A records map names to IPv4 addresses; alias records point to supported Azure resources - [Private DNS](https://learn.microsoft.com/en-us/azure/dns/private-dns-overview) resolves private names through virtual network links - Create the zone → add records → delegate or link the zone → test name resolution ## M05 - Intersite Connectivity ### Virtual network peering - [VNet peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview) connects virtual networks over the Microsoft backbone with private IP addresses - Peering is non-transitive; each required virtual network relationship must be configured explicitly - Forwarded traffic and gateway transit settings control hub-spoke connectivity ### Routes and network virtual appliances - System routes provide default paths; [user-defined routes](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview) send traffic to a selected next hop - Route table + UDR + network virtual appliance controls traffic through a custom path - The appliance network interface and guest operating system must both support IP forwarding - [Service chaining](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service-chaining) directs traffic from one virtual network through a virtual appliance in another ### Connectivity topologies - [Hub-spoke](https://learn.microsoft.com/en-us/azure/architecture/networking/architecture/hub-spoke) centralizes shared connectivity while isolating workloads in spokes - Gateway transit lets peered spokes use a VPN gateway in the hub - Site-to-site connects networks; point-to-site connects individual clients; VNet-to-VNet connects Azure virtual networks through VPN gateways ## M06 - Network Traffic Management ### Azure Load Balancer - Azure Load Balancer distributes TCP and UDP flows at Layer 4 - Frontend IP configuration + rule + backend pool + health probe defines traffic distribution - Choose Load Balancer for high-performance regional network traffic that does not require application-layer routing ### Azure Application Gateway - [Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-autoscaling-zone-redundant) provides Layer 7 routing for HTTP and HTTPS applications - Listener → rule → backend pool and settings → health probe defines request processing - [Path-based routing](https://learn.microsoft.com/en-us/azure/application-gateway/url-route-overview) sends URL paths to different backends; WAF adds web application protection ### Azure Network Watcher - [Network Watcher](https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview) monitors and troubleshoots IaaS network connectivity - Representative tools inspect topology, effective paths, security decisions, connections, and packets - Connection Monitor continuously tests reachability and latency between endpoints ## M07 - Storage ### Storage accounts - General-purpose v2 supports Blob, Files, Queue, and Table services; premium accounts target specific workloads - [LRS / ZRS / GRS / GZRS](https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy) provide local, zonal, geo-replicated, and geo-zone-redundant choices - Service endpoints secure access from selected subnets; [private endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview) assign a private IP address for a storage service ### Blob Storage - Containers organize blobs; block, append, and page blobs support different data-access patterns - [Hot / Cool / Cold / Archive](https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview?tabs=azure-portal) balance storage cost, access cost, and retrieval latency - [Lifecycle management](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview) tiers or deletes blobs by rule; object replication asynchronously copies block blobs - Capacity, operations, data retrieval, redundancy, and tier changes contribute to pricing ### Storage security - [Shared access signatures](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) delegate scoped permissions for a defined resource and time window - A SAS URI combines the resource address with signed parameters such as permissions, start, and expiry - Storage encryption protects data at rest; customer-managed keys give the customer control over key lifecycle ### Azure Files - Azure Files provides managed file shares; Blob Storage provides object storage - Snapshots and soft delete support recovery from deletion or change - Storage Explorer manages storage data through a graphical tool - Azure File Sync caches Azure file shares on Windows Servers; cloud tiering keeps frequently used files local ## M08 - VM ### Plan and create virtual machines - Choose region, availability option, image, [size](https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/overview), storage, networking, and authentication before creation - Azure portal, ARM templates, PowerShell, Azure CLI, REST, and SDKs provide different creation workflows - OS disks and data disks persist; the temporary disk is local to the host and is not durable ### Manage virtual machines - [Managed disks](https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview) simplify disk management and offer performance tiers for different workloads - VM extensions add post-deployment configuration, monitoring, security, and automation - Administrative services support ongoing configuration and management; Azure Backup provides recovery protection ### Availability and scale - Availability sets distribute VMs across fault and update domains; availability zones distribute them across datacenters - [Virtual Machine Scale Sets](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview) create and manage a group of load-balanced VMs with autoscale - Vertical scaling changes VM size; horizontal scaling changes instance count ## M09 - Platform Service Computing ### App Service plans - An App Service plan defines region, operating system, compute resources, pricing tier, and scaling capacity - Scale up changes the plan tier or worker size; scale out changes the number of worker instances ### Azure App Service - Create an app → configure deployment or CI/CD → validate the running application - Deployment slots provide isolated staging environments and controlled swaps into production - App Service security, custom domains and certificates, and backup/restore protect the application lifecycle ### Application Insights - Application Insights monitors application availability, performance, failures, and usage - Enable monitoring for an App Service app and use collected telemetry to investigate behavior ### Azure Container Instances and container platforms - Containers share a host operating system; virtual machines include a complete guest operating system - [Azure Container Instances](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups) runs single or multi-container groups without managing an orchestrator - [Azure Container Apps](https://learn.microsoft.com/en-us/azure/container-apps/overview) supports serverless APIs, background jobs, event-driven processing, and microservices - Container Apps can scale from HTTP, events, CPU/memory, or KEDA scalers and is built on Dapr, KEDA, and Envoy - Container Apps abstracts Kubernetes APIs; AKS provides direct Kubernetes control for complex orchestration ## M10 - Backup ### Azure Backup fundamentals - [Azure Backup](https://learn.microsoft.com/en-us/azure/backup/backup-overview) provides policy-driven protection for supported Azure and hybrid workloads - Recovery Services vaults and Backup vaults store recovery points for the workloads they support - Match workload, recovery requirements, retention, and storage tier to the backup scenario ### VM backup - Configure a vault and backup policy → enable protection for the VM → create scheduled or on-demand recovery points - Backup policy defines schedule and retention; snapshot and vault tiers support operational and longer-term recovery - Backup protects recoverable copies of data; replication and failover address workload continuity ### Restore VM data - Restore a complete VM when the original workload must be recreated - Restore disks when recovery requires controlled VM reconstruction or data access - File recovery mounts a recovery point so individual files can be selected and restored ## M11 - Monitor ### VM monitoring data and diagnostics - Host metrics describe the Azure platform view; guest performance counters and event logs describe the operating system view - Metrics are numeric time-series data; logs are structured records for detailed queries and correlation - Configure the recommended diagnostics and data sources for the VM monitoring requirement ### Metrics, alerts, and VM insights - Metrics Explorer charts host metrics and helps compare values over time - Recommended VM alerts provide a starting set of common health and performance conditions - VM insights combines performance and dependency views for monitored virtual machines ### Guest monitoring and log analysis - Azure Monitor Agent collects guest data according to data collection rules - DCRs select performance counters and Windows event logs and route them to a Log Analytics workspace - [Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial) analyzes collected data with [Kusto Query Language](https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true) ``` ## Whiteboard ### Whiteboard ![Whiteboard](https://mdcontent.yu.money/contents/31b5b0d6ee886b9be732c5f11.png) SVG: [Whiteboard.svg](https://mttcontent.yu.money/az104/Whiteboard.svg) ### OneNotes [47392-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/47392-AZ-104.pdf) [49023-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/49023-AZ-104.pdf) [49459-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/49459-AZ-104.pdf) [50101-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/50101-AZ-104.pdf) [50488-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/50488-AZ-104.pdf) [52348-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/52348-AZ-104.pdf) [52357-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/52357-AZ-104.pdf) [55239-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/55239-AZ-104.pdf) [59711-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/59711-AZ-104.pdf) [64357-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/64357-AZ-104.pdf) [65790-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/65790-AZ-104.pdf) [81161-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/81161-AZ-104.pdf) [83715-AZ-104.pdf](https://mttcontent.yu.money/az104/notes/83715-AZ-104.pdf) ## Exam [AZ-104 Exam Page](https://learn.microsoft.com/en-us/credentials/certifications/exams/az-104)  [Exam duration and question types](https://learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience) [AZ-104 Practice Exam](https://learn.microsoft.com/en-us/credentials/certifications/azure-administrator/practice/assessment?assessment-type=practice&assessmentId=21&practice-assessment-type=certification) [AZ-104 Study Guide](https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104) [AZ-104 Exam Prep videos](https://learn.microsoft.com/en-us/shows/exam-readiness-zone/preparing-for-az-104-manage-azure-identities-and-governance-1-of-5/) [Unscheduled breaks now available in most exams without requesting in advance](https://techcommunity.microsoft.com/blog/skills-hub-blog/unscheduled-breaks-now-available-in-most-exams-without-requesting-in-advance/3287005) [AZ-104 Exam Readiness Zone](https://learn.microsoft.com/en-us/shows/exam-readiness-zone/?terms=AZ-104) [AZ-104 Exam Sandbox](https://aka.ms/examdemo) [Microsoft Exam FAQ](https://learn.microsoft.com/en-us/credentials/certifications/online-exams) [Renew your Microsoft Certifications for free. Stay Microsoft Certified!](https://aka.ms/RenewYourCertVideo) [Microsoft Learn for all role-based Microsoft Certification exams](https://techcommunity.microsoft.com/blog/skills-hub-blog/introducing-a-new-resource-for-all-role-based-microsoft-certification-exams/3500870)  ![exam](https://mdcontent.yu.money/contents/31b5b0d6ee886b9be732c5f03.png) SVG: [exam.svg](https://mttcontent.yu.money/common/exam.svg) ## Contact - Money Yu - Mail: [Money.Yu@microsoft.com](mailto:Money.Yu@microsoft.com) - LinkedIn: [@abc12207](https://www.linkedin.com/in/abc12207/)