Model	You manage	Azure manages	Azure example
IaaS — Infrastructure as a Service	OS, runtime, apps, data	Servers, storage, networking, virtualisation	Azure Virtual Machines
PaaS — Platform as a Service	Applications and data only	OS, runtime, middleware, infrastructure	Azure App Service, Azure SQL
SaaS — Software as a Service	Data and access settings	Everything else	Microsoft 365, Dynamics 365

Plan Family	Target	User limit	Key features
M365 Business Basic	Small business	Up to 300 users	Web/mobile Office apps, Exchange, Teams, SharePoint, OneDrive
M365 Business Standard	Small business	Up to 300 users	+ Desktop Office apps (Word, Excel, PowerPoint), Teams webinars
M365 Business Premium	Small business	Up to 300 users	+ Intune, Defender for Business, Entra ID P1, Azure Information Protection P1
M365 E3	Enterprise	Unlimited	+ Entra ID P1, Intune, Purview, compliance tools, advanced analytics
M365 E5	Enterprise	Unlimited	+ Defender for Office P2, Defender for Endpoint P2, Entra ID P2, Power BI Pro, Purview Premium

Associate · AZ-104

Azure Administrator (AZ-104)
Complete Study Guide

The AZ-104 is the core hands-on Azure admin certification. This free guide covers all five exam domains in full — manage identities, governance, storage, compute, and networking on Azure. Pass first time.

Exam domains

40–60

Questions

700

Pass score / 1000

Free

This guide

ℹ️

About this guide: AZ-104 has five domains tested in a mix of multiple choice, case studies, and hands-on lab questions. Prerequisites: Microsoft recommends 6 months of hands-on Azure experience. The exam rewards practical knowledge — use the Azure portal as you study.

Domain 1

Manage Azure Identities and Governance

15–20%

This domain covers Entra ID user and group management, RBAC, subscriptions, and Azure Policy. It's heavily tested with scenario questions about who should have what access and how to enforce governance at scale.

🪪Entra ID Users and Groups

Creating users: You can create users in the Entra admin centre, via PowerShell (New-MgUser), or bulk import via CSV. Users can be cloud-only (created in Entra ID) or synced from on-premises AD DS via Entra Connect.

Guest users (B2B): External users invited to collaborate. They authenticate with their own organisation's identity. Manage them under External Identities. You can restrict what guest users can see and do in your tenant.

Group types — know both:

Security groups — used to assign access to resources (RBAC, app access, licence assignment). Members: users, devices, service principals, other groups.
Microsoft 365 groups — include a shared mailbox, Teams workspace, SharePoint site, Planner. Used for collaboration.

Membership types:

Assigned — you manually add members. Simple, doesn't scale.
Dynamic user — membership rule based on user attributes (e.g. department -eq "Finance"). Automatically adds/removes users as attributes change. Requires Entra ID P1.
Dynamic device — same concept but for devices.

📝

Exam tip: Dynamic groups require Entra ID P1. The exam gives you scenarios like "automatically add all Finance department users to a group" — the answer is always dynamic group with a membership rule.

🔐Azure RBAC in Depth

Role assignment anatomy: Every role assignment has three parts: a security principal (who), a role definition (what permissions), and a scope (where it applies). Assignments are inherited down — a Contributor at the subscription level is a Contributor on all resource groups and resources in that subscription.

Key built-in roles for the exam:

Owner — full control including ability to grant access to others
Contributor — create/manage all resources, cannot grant access
Reader — view everything, change nothing
User Access Administrator — manage access to Azure resources, cannot manage the resources themselves
Virtual Machine Contributor — manage VMs but not the VNet or storage account they use
Network Contributor — manage virtual networks, not VMs
Storage Blob Data Contributor — read/write/delete blob data. Note: different from Contributor — Contributor can manage the storage account but not necessarily access the data within it.

Custom roles: When no built-in role fits, create a custom role with exactly the actions needed. Defined in JSON, scoped to specific subscriptions. Limit of 5,000 custom roles per tenant.

⚠️

Classic admin roles are legacy: The exam may still mention Service Administrator and Co-Administrator — these are classic roles from the pre-ARM era. For new environments, always use RBAC, not classic admin roles.

📋Azure Policy and Blueprints

Azure Policy evaluates resources against rules you define. Policies can:

Audit — flag non-compliant resources but take no action
Deny — prevent creation of non-compliant resources
Append — add required fields to a resource (e.g. force a specific tag value)
DeployIfNotExists / AuditIfNotExists — trigger deployment of a remediation resource if a condition is missing (e.g. deploy a diagnostic setting if one doesn't exist)
Modify — add, update, or remove tags on existing resources

Policy initiatives (also called policy sets) group multiple policies together. For example, the "Azure Security Benchmark" initiative bundles 200+ policies. Assign the initiative to a scope rather than assigning each policy individually.

Remediation tasks: Existing non-compliant resources are not automatically fixed when a policy is assigned — you need to create a remediation task manually (or configure automatic remediation for DeployIfNotExists policies). The policy's managed identity performs the remediation.

📝

Exam tip: Policy applies at assignment time. Resources created before a Deny policy was assigned are not deleted — they just show as non-compliant. Only new resource creation is blocked.

Management groups: Assign policies at a management group to enforce them across all child subscriptions. This is how enterprises enforce standards like "all resources must be in approved regions" across 50+ subscriptions simultaneously.

💰Subscriptions and Cost Management

Subscription limits: Azure subscriptions have hard limits on some resources (e.g. 980 resource groups per subscription, 250 storage accounts per region). Plan your subscription architecture around these limits for large environments.
Moving resources: Resources can be moved between resource groups or subscriptions using the "Move" function. Not all resource types support moving. When moving, the resource's ID changes. Locks on the resource group must be removed first.
Spending limits: Free and pay-as-you-go trial subscriptions have spending limits that stop services when reached. Production subscriptions typically have no spending limit — configure budgets instead.
Cost alerts: Set budgets in Azure Cost Management with alerts at 80%, 100%, and 120% of budget. Alerts can trigger action groups (email, Teams, Logic App).
Tags for cost allocation: Use tags (Environment, CostCentre, Project) and Azure Cost Management to show spending per tag. Enforce tagging with Azure Policy.

Domain 2

Implement and Manage Storage

15–20%

Storage is a significant exam topic. You need to understand storage account types, access controls, redundancy, lifecycle management, and Azure File Sync. Expect scenario questions about which storage type to use and how to secure access.

💾Storage Account Types and Performance Tiers

Storage account kinds:

Standard general-purpose v2 (GPv2) — the default. Supports Blob, File, Queue, Table. Use for most workloads.
Premium block blobs — SSD-backed, for high-transaction scenarios (AI/ML data ingestion, IoT telemetry). Blob only.
Premium file shares — SSD-backed Azure Files. For latency-sensitive applications needing SMB file shares.
Premium page blobs — for virtual machine OS and data disks (unmanaged). Less common now that managed disks are standard.

Access tiers for blob storage:

Hot — frequently accessed data. Highest storage cost, lowest access cost.
Cool — infrequently accessed (at least 30 days). Lower storage cost, higher access cost. Early deletion penalty if deleted before 30 days.
Cold — rarely accessed (at least 90 days). Even lower storage cost.
Archive — rarely accessed (at least 180 days). Cheapest storage, but data is offline — must be "rehydrated" to Hot or Cool before access (takes hours). Cannot be read directly.

📝

Archive rehydration: Moving a blob from Archive to Hot/Cool is called rehydration. Standard priority takes up to 15 hours. High priority takes under 1 hour but costs more. The exam asks about this timing.

🔒Storage Access Control

Access keys: Every storage account has two 512-bit access keys — full administrative access to all data. Rotate them regularly. Anyone with a key can read, write, and delete everything. Avoid using keys directly in application code — use Managed Identities or SAS tokens instead.

Shared Access Signatures (SAS): Time-limited, permission-scoped URIs that grant specific access to specific storage resources without exposing the account key.

Account SAS — grants access to one or more storage services
Service SAS — grants access to a specific resource in one service (a single container, blob, queue, or table)
User delegation SAS — signed with Entra ID credentials rather than the account key. More secure — recommended approach. Requires Entra ID RBAC.

Stored access policies: Define a policy on a container that SAS tokens can reference. If you need to revoke a SAS, delete or modify the stored access policy rather than rotating the account key.

Entra ID authentication (RBAC for storage): Use roles like Storage Blob Data Contributor to grant a user or managed identity access to blob data without using keys. This is the most secure approach for application access.

Network access controls: Restrict storage account access to specific VNets (service endpoints or private endpoints) or IP ranges via the Storage account → Networking → Firewalls and virtual networks settings. Enable "Allow Azure services" only if needed.

📁Azure Files and File Sync

Azure Files provides fully managed file shares accessible via SMB 3.0 and NFS 4.1. Mount them on Windows, Linux, and macOS. Use cases: lift-and-shift of on-premises file servers, shared configuration files for applications, dev/test environments.

Azure File Sync extends Azure Files to on-premises Windows Server. Synchronises files between a Windows Server and an Azure File share, with optional cloud tiering — less frequently accessed files are automatically replaced by a pointer, freeing up local disk space while keeping files accessible (they download on-demand).

Components of Azure File Sync:

Storage Sync Service — the top-level Azure resource, like a container for sync groups
Sync group — defines the sync topology: one cloud endpoint (Azure file share) + one or more server endpoints
Cloud endpoint — the Azure file share being synced
Server endpoint — a specific path on a registered Windows Server
Registered server — a Windows Server (or VM) with the Azure File Sync agent installed, trusted by the Storage Sync Service

✅

Cloud tiering: When enabled, files not accessed in X days are tiered to the cloud. The file still appears locally (as a reparse point). When opened, it downloads transparently. Free space policy and date policy control what gets tiered. Tiered files show a cloud overlay icon in Explorer.

🔄Storage Redundancy and Replication

Redundancy	Copies	Scope	Use when
LRS — Locally Redundant	3	Single data centre	Cost-sensitive, can tolerate data centre failure
ZRS — Zone Redundant	3	3 availability zones in one region	High availability within a region
GRS — Geo Redundant	6 (3+3)	Primary + secondary region	Disaster recovery, secondary is read-only only on failover
GZRS — Geo-Zone Redundant	6	ZRS primary + LRS secondary	Highest availability + geo protection
RA-GRS / RA-GZRS	6	Same as GRS/GZRS	Read access to secondary region at all times (not just on failover)

The secondary region is determined by Azure — you don't choose it. It's always a fixed pair (e.g. UK South pairs with UK West). You can initiate an account failover to promote the secondary to primary during a regional outage, but this has data loss implications.

♻️Lifecycle Management and Object Replication

Lifecycle management policies automatically transition blobs between access tiers or delete them based on rules:

Move blobs to Cool if not modified for 30 days
Move blobs to Archive if not modified for 90 days
Delete blobs if not modified for 365 days

Policies are defined in JSON and applied at the storage account level. Filters can target specific containers or blob prefixes.

Object replication asynchronously replicates block blobs from a source storage account to a destination account (can be in a different region or subscription). Useful for keeping a copy of data in another geography, or feeding a CDN account. Requires versioning and change feed to be enabled on the source.

Immutability policies (WORM): Write Once Read Many — prevent blobs from being modified or deleted for a defined period. Used for compliance: financial records, healthcare data. Two types: time-based retention policies and legal holds.

Domain 3

Deploy and Manage Azure Compute Resources

20–25%

Compute is the largest domain. VMs, availability sets, scale sets, App Service, containers, and ARM/Bicep templates are all tested. Expect scenario questions about choosing the right compute service and configuring VMs for high availability.

💻Azure Virtual Machines — Core Concepts

VM sizing families: Azure VMs come in families optimised for different workloads. Key ones for the exam:

B-series — burstable, credit-based CPU. Good for workloads with low baseline CPU and occasional spikes (dev/test, small web servers)
D-series — general purpose. Balanced CPU/memory ratio. Most common for application servers
E-series — memory optimised. For databases, in-memory analytics (SQL Server, SAP HANA)
F-series — compute optimised. High CPU-to-memory ratio. Good for batch processing, gaming servers
N-series — GPU enabled. For machine learning, video rendering, scientific simulations
L-series — storage optimised. High disk throughput and IOPS. For NoSQL databases, data warehousing

VM disks:

OS disk — required, contains the operating system. Default is Premium SSD or Standard HDD depending on VM size
Temporary disk — local to the physical host, not persisted across deallocations (reboots are fine). Use for temp files only, never store data here
Data disks — additional managed disks attached for application data. Persisted independently of VM lifecycle

Managed disk types: Ultra Disk (highest performance, sub-millisecond latency), Premium SSD v2, Premium SSD, Standard SSD, Standard HDD. Choose based on IOPS and throughput requirements vs cost.

🏗️High Availability: Availability Sets and Zones

Availability Sets protect against hardware failures within a single data centre by spreading VMs across:

Fault domains (FD) — separate physical racks with independent power and networking. Up to 3 FDs. Two VMs in different FDs survive a rack failure.
Update domains (UD) — VMs in different UDs are not rebooted simultaneously during planned maintenance. Up to 20 UDs.

Availability Sets give a 99.95% SLA. They protect only within one data centre — a full data centre failure takes down all VMs in an availability set.

Availability Zones spread VMs across physically separate data centres within a region (each with independent power, cooling, networking). Deploy VMs to Zone 1, 2, and 3 for 99.99% SLA. Protects against data centre failure. Not available in all regions.

📝

Key scenario: "You need to protect two VMs from planned maintenance reboots affecting both simultaneously" → Availability Set. "You need to protect against an entire data centre failure" → Availability Zones. These are the most common AZ-104 compute scenarios.

VM Scale Sets (VMSS): Deploy and manage a group of identical, load-balanced VMs. Scale manually or automatically based on CPU, memory, custom metrics, or schedule. Two orchestration modes:

Uniform — identical VM instances. Simpler, better for stateless workloads
Flexible — can mix VM sizes, supports up to 1,000 instances, works with Availability Zones

⚙️VM Configuration: Extensions, Custom Script, and DSC

VM Extensions are small applications that provide post-deployment configuration and automation on Azure VMs. They run after VM deployment without needing you to RDP/SSH in.

Custom Script Extension — runs a PowerShell or shell script on a VM. Use to install software, configure settings, or run any command. Script can be hosted in Azure Storage or a public URI.
Azure Monitor Agent — collects performance metrics and logs from VMs and sends to a Log Analytics workspace.
Microsoft Antimalware extension — deploys and configures Microsoft Antimalware (Windows Defender) on VMs.
Azure AD Login extension — enables sign-in to a VM using Entra ID credentials instead of local accounts.

Desired State Configuration (DSC): PowerShell-based configuration management. Define the desired state of a VM (IIS installed, specific services running, files in place) and DSC ensures the VM stays in that state.

Run Command: Execute scripts on a VM directly from the Azure portal or CLI without opening firewall ports or using SSH/RDP. Useful for emergency access when normal connectivity is broken.

🌐Azure App Service

App Service is a PaaS platform for hosting web applications, REST APIs, and mobile backends. You manage code and configuration; Azure manages the OS, runtime, patching, and scaling.

App Service Plans define the region, OS, and compute capacity for your app. Multiple apps can share one plan. Key tiers:

Free/Shared — dev/test only, shared infrastructure, no SLA, limited features
Basic — dedicated compute, manual scale, no auto-scale, no slots
Standard — auto-scale, deployment slots, custom domains, SSL, VNet integration
Premium — more compute options, more slots, zone redundancy available
Isolated / Isolated v2 — dedicated, fully isolated environment (App Service Environment / ASE). For strict compliance, private networking requirements

Deployment slots: Named environments (staging, production) within the same App Service. Deploy to staging, test, then swap slots with zero downtime. Blue-green deployment pattern.

App Service networking:

VNet Integration — allows the app to make outbound calls into a VNet (to reach databases, internal APIs). The app still has a public inbound endpoint.
Private Endpoints — give the App Service a private IP on a VNet, making it accessible only from the VNet (inbound traffic). Removes the public endpoint.
Access restrictions — IP-based allow/deny rules on the app's inbound traffic.

📦Containers: ACI and AKS

Azure Container Instances (ACI): The fastest way to run a Docker container in Azure. No VM management, no cluster setup. Billed per second of use. Best for: short-lived jobs, burst compute, simple applications, CI/CD build agents.

ACI supports Linux and Windows containers, can mount Azure File shares for persistent storage, and supports container groups (multiple containers sharing a network and lifecycle — similar to Kubernetes pods).

Azure Kubernetes Service (AKS): Managed Kubernetes. Azure manages the control plane (API server, etcd); you manage the node pools (VMs running your workloads).

Node pools — groups of VMs with the same size. A system node pool runs Kubernetes system services; user node pools run your application workloads.
Cluster autoscaler — automatically adds or removes nodes based on pod scheduling demands.
Azure CNI / kubenet — two networking models. Azure CNI gives each pod its own VNet IP (recommended for most production scenarios); kubenet uses NAT.
ACR integration — AKS clusters use a managed identity to pull images from Azure Container Registry without storing credentials.

✅

ACI vs AKS: The exam often asks when to use each. ACI = simple, fast, short-lived, serverless containers. AKS = complex multi-container applications, need orchestration, auto-scaling, rolling updates, persistent workloads.

📄ARM Templates and Bicep

The AZ-104 exam tests practical IaC knowledge — you need to understand ARM template structure and be able to read Bicep syntax.

ARM template sections:

$schema — identifies the template schema version
contentVersion — your versioning for the template
parameters — values passed at deployment time (with types, defaults, allowed values)
variables — computed values reused throughout the template
resources — the resources to deploy (required)
outputs — values returned after deployment

dependsOn: Explicitly declare dependencies between resources when ARM can't infer them automatically. Example: a VM extension must deploy after the VM.

linked and nested templates: Break large templates into smaller files. Linked templates reference an external URI. Nested templates are defined inline within the parent template. Both help manage complexity and enable reuse.

Deployment scopes: Templates can deploy at resource group, subscription, management group, or tenant scope. Most deployments are at resource group scope. Subscription-scope deployments create resource groups and assign policies. Use az deployment sub create for subscription-level deployments.

Domain 4

Implement and Manage Virtual Networking

20–25%

Networking is consistently the most challenging domain for AZ-104 candidates. VNets, NSGs, routing, load balancers, VPN Gateway, and DNS — all tested with scenario questions. Read carefully: many scenarios hinge on a single configuration detail.

🌐Virtual Networks and Subnets

VNet basics: A Virtual Network (VNet) is an isolated, private network in Azure. Resources in the same VNet can communicate by default. VNets are scoped to a single region and subscription.

Address space: Defined using CIDR notation (e.g. 10.0.0.0/16 gives 65,536 IP addresses). Cannot overlap with other VNets you peer with or your on-premises networks. Plan address spaces carefully — they're hard to change after resources are deployed.

Subnets: Subdivisions of a VNet's address space. Each resource goes into a subnet. Azure reserves 5 addresses per subnet (first 4 + last): network address, gateway, DNS, broadcast, and another for Azure internal use. A /29 subnet gives only 3 usable addresses — use /27 or larger for production.

Special subnets:

GatewaySubnet — required for VPN Gateway and ExpressRoute gateways. Must be named exactly "GatewaySubnet". Use at least /27.
AzureBastionSubnet — required for Azure Bastion. Must be named exactly "AzureBastionSubnet". Must be at least /26.
AzureFirewallSubnet — required for Azure Firewall. Must be named exactly "AzureFirewallSubnet". Must be /26 or larger.

📝

Exam tip: The exact names "GatewaySubnet", "AzureBastionSubnet", and "AzureFirewallSubnet" are tested. These names are case-sensitive and cannot be anything else for the respective services to work.

🛡️Network Security Groups (NSGs)

NSGs are stateful firewalls containing inbound and outbound security rules. Each rule specifies: priority (100–4096, lower = higher priority), source/destination (IP, CIDR, service tag, or application security group), port, protocol, and Allow/Deny action.

Where NSGs can be applied:

Subnet — applies to all traffic entering/leaving the subnet
Network interface (NIC) — applies to a specific VM's traffic

Traffic evaluation when both subnet and NIC NSGs exist: inbound — subnet NSG evaluated first, then NIC NSG. Outbound — NIC NSG first, then subnet NSG. Both must allow traffic for it to pass.

Default rules (cannot be deleted, can be overridden with lower priority number):

AllowVNetInBound (65000) — allows traffic from VNet address space
AllowAzureLoadBalancerInBound (65001) — allows Azure load balancer health probes
DenyAllInBound (65500) — denies everything else inbound

Service tags: Named groups of IP prefixes managed by Microsoft. Use instead of hardcoding IP ranges. Examples: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AppService.

Application Security Groups (ASGs): Group VMs logically by role (e.g. "WebServers", "DatabaseServers") and use ASG names in NSG rules instead of IP addresses. Rules automatically apply to all VMs in the ASG. Simplifies rule management as IPs change.

🔀VNet Peering and Routing

VNet peering connects two VNets (in the same or different regions, same or different subscriptions, same or different tenants) so their resources can communicate using private IP addresses. Traffic stays on the Microsoft backbone — never traverses the public internet.

Peering is non-transitive: if VNet A peers with VNet B, and VNet B peers with VNet C, VNet A cannot communicate with VNet C through VNet B. You need to peer A to C directly, or use a hub VNet with a gateway or NVA to route between them.

Key peering settings:

Allow gateway transit — allows the peered VNet to use this VNet's VPN gateway to connect to on-premises
Use remote gateways — the peered VNet uses the remote VNet's gateway (must have Allow gateway transit enabled on the other side)

User-defined routes (UDR): Override Azure's default routing by creating a route table and associating it with a subnet. Common use: force all internet traffic through a Network Virtual Appliance (NVA) or Azure Firewall for inspection. Next hop types: Virtual appliance (specify NVA IP), Virtual network gateway, VNet, Internet, None (drop the traffic).

Azure Firewall vs NSG: NSGs are simple allow/deny rules at layer 4. Azure Firewall is a managed, stateful firewall with layer 7 filtering, FQDN rules, threat intelligence, and centralised logging. Use Azure Firewall for hub-and-spoke architectures where you need centralised egress inspection.

⚖️Load Balancing Services

Service	Layer	Scope	Use for
Azure Load Balancer	Layer 4 (TCP/UDP)	Regional	Load balance VMs within a region, internal or public
Application Gateway	Layer 7 (HTTP/S)	Regional	Web apps needing URL routing, SSL termination, WAF
Azure Front Door	Layer 7 (HTTP/S)	Global	Global web apps, CDN, WAF, anycast routing
Traffic Manager	DNS	Global	DNS-based routing across regions, failover, geographic routing

Azure Load Balancer SKUs: Standard (zone-redundant, supports availability zones, HTTPS health probes, outbound rules) vs Basic (free, no zone support, no SLA). Always use Standard for production.

Application Gateway components: Frontend IP, Listener (port/protocol/hostname), Rules (map listeners to backend pools), Backend pools (VMs, VMSS, App Service, IPs), HTTP settings, Health probes.

WAF on Application Gateway: Web Application Firewall protects against OWASP top 10 (SQL injection, XSS, etc.). Detection mode logs and alerts; Prevention mode blocks malicious requests.

🔗VPN Gateway and ExpressRoute

VPN Gateway connects on-premises networks to Azure VNets over encrypted IPsec/IKE tunnels across the public internet.

Site-to-site (S2S) — connects an on-premises VPN device to Azure. Persistent, always-on connection.
Point-to-site (P2S) — individual devices (laptops, workstations) connect to Azure VNet. Uses certificates, Entra ID, or RADIUS authentication. Good for remote workers.
VNet-to-VNet — connect two Azure VNets via VPN. Usually VNet peering is preferred (lower latency, higher bandwidth, simpler), but VNet-to-VNet VPN works across subscriptions and tenants without peering.

VPN Gateway SKUs: VpnGw1 through VpnGw5 (and AZ variants for zone-redundancy). Higher SKUs = more bandwidth and more S2S tunnels. Active-active mode uses two VPN instances for higher resilience.

ExpressRoute — dedicated private connectivity from on-premises to Azure, not over the internet. Offered through connectivity providers (BT, Equinix, Megaport etc.).

Bandwidth: 50 Mbps to 100 Gbps
SLA: 99.95% uptime
ExpressRoute Global Reach — connect two on-premises sites to each other through the Microsoft backbone via their respective ExpressRoute circuits
ExpressRoute FastPath — bypasses the ExpressRoute gateway for data path traffic, reducing latency

🔍Azure DNS

Public DNS zones: Host your public domain's DNS records in Azure DNS. Delegate from your registrar by setting Azure DNS name servers. Azure DNS is not a domain registrar — buy the domain elsewhere, then host the DNS in Azure.

Private DNS zones: Resolve names within your VNets without exposing records to the internet. Link a private DNS zone to VNets — VMs in those VNets resolve records in the zone automatically. Common pattern: use privatelink.blob.core.windows.net zone for storage private endpoints.

Azure-provided DNS (168.63.129.16): Default DNS for VMs in a VNet. Resolves Azure service names and forwards external queries to Azure's public resolvers. Can be replaced with custom DNS servers (point to your own DNS VM or Azure DNS Resolver).

Azure DNS Private Resolver: A managed DNS service that lets you query Azure private DNS zones from on-premises over ExpressRoute or VPN without deploying DNS server VMs. Inbound endpoints accept queries from on-premises; outbound endpoints forward queries to on-premises DNS servers.

Domain 5

Monitor and Maintain Azure Resources

10–15%

The final domain covers monitoring, backup, and site recovery. Smaller in weight but often the difference between passing and failing — these are "easy marks" if you know the tools.

📊Azure Monitor

Azure Monitor is the central platform for all monitoring in Azure. It collects two types of data:

Metrics — numerical time-series data (CPU percentage, disk read bytes/sec, network in/out). Available for 93 days. Near real-time, sampled at 1-minute intervals by default.
Logs — structured and unstructured data sent to a Log Analytics workspace. Query with KQL (Kusto Query Language). Retention configurable from 30 to 730 days (longer with Basic logs).

Diagnostic settings: Configure each resource to send its metrics and logs somewhere — a Log Analytics workspace, a Storage account, or an Event Hub. Not all data flows automatically — diagnostic settings must be explicitly configured per resource.

Alerts: Trigger when a metric or log query crosses a threshold. Alert rules have: scope (what resource), condition (what to watch), action group (what to do), and severity (0–4).

Action groups: Define what happens when an alert fires — email, SMS, push notification, voice call, webhook, Azure Function, Logic App, ITSM integration, Automation runbook.

Log Analytics workspaces: The central repository for logs. Multiple resources across multiple subscriptions can send to the same workspace. KQL query examples the exam tests:

Heartbeat | summarize LastCall = max(TimeGenerated) by Computer — find when VMs last reported in
AzureActivity | where OperationName == "Delete Virtual Machine" — audit VM deletions

🔍Azure Monitor Insights and Application Insights

VM Insights — pre-built monitoring for VMs: performance charts, process and dependency maps, without writing KQL queries. Requires Azure Monitor Agent and a Log Analytics workspace.
Container Insights — monitoring for AKS clusters and container workloads. Shows node and pod performance, logs from containers.
Network Insights — topology view of your networking resources, health status, and connectivity diagnostics.
Application Insights — APM (Application Performance Monitoring) for web applications. Tracks request rates, response times, failure rates, exceptions, dependencies. Requires SDK or auto-instrumentation in your app code. Stores data in a Log Analytics workspace.

💾Azure Backup

Azure Backup protects Azure VMs, SQL Server in Azure VMs, Azure Files, on-premises servers, and more.

Recovery Services Vault: The container for backup data and policies. Must be in the same region as the resources being backed up. Configure backup policies to define: frequency (daily, weekly), time, and retention (daily, weekly, monthly, yearly restore points).

Backup for Azure VMs:

Application-consistent backups using VSS (Volume Shadow Copy) on Windows
File-system-consistent backups on Linux (using pre/post scripts)
Supports both managed and unmanaged disks
Instant restore — restore from recent snapshots (1–5 days) without waiting for data transfer from the vault
Cross-region restore — restore a VM backup into a secondary region (if GRS vault)

Soft delete: When enabled, deleted backup data is retained for 14 additional days before permanent deletion. Protects against accidental or malicious deletion of backup data. Enabled by default on new vaults.

Backup Centre: A unified management experience for all backup across subscriptions and vaults from one place.

🔄Azure Site Recovery (ASR)

Azure Site Recovery is a disaster recovery (DR) service — it continuously replicates VMs from a primary location to a secondary and enables failover.

Supported scenarios:

Azure-to-Azure — replicate Azure VMs from one region to another (most common)
On-premises VMware/Hyper-V to Azure — replicate on-premises VMs to Azure for DR
Physical server to Azure — replicate physical Windows/Linux servers to Azure

Key concepts:

RPO (Recovery Point Objective) — maximum acceptable data loss. ASR for Azure VMs offers RPO of minutes (crash-consistent recovery points every 5 minutes, app-consistent every hour).
RTO (Recovery Time Objective) — maximum acceptable downtime. ASR enables failover in minutes.
Recovery plans — orchestrate failover of multiple VMs in sequence with optional Azure Automation runbooks between steps. Use for multi-tier applications (database first, then application tier, then web tier).
Test failover — validate DR readiness without impacting production. Brings up the replica VMs in an isolated test VNet.

📝

Backup vs ASR: Azure Backup = restore from a point-in-time backup (data protection). Azure Site Recovery = replicate and failover to a running replica (disaster recovery / business continuity). Both use Recovery Services Vaults. The exam often asks which to use for a given RPO/RTO requirement.

Exam Day

Strategy, Tips, and What to Expect

🎯Exam Format

Questions: 40–60 questions. Mix of multiple choice, multiple select, drag-and-drop, case studies, and hands-on labs (not all sittings include labs)
Duration: 120 minutes (plus 20 minutes admin time)
Passing score: 700 out of 1000
Cost: ~£165 / $165 USD
Prerequisite recommended: AZ-900 or equivalent knowledge. Not mandatory.
Validity: 1 year, then requires renewal (free online assessment to renew)

📋Top 15 Things to Know

Dynamic groups require Entra ID P1 and use membership rules based on user/device attributes
Availability Sets protect within one data centre (FDs/UDs). Availability Zones protect across data centres (99.99% SLA)
Archive blobs must be rehydrated before access — standard rehydration takes up to 15 hours
User delegation SAS is signed with Entra ID credentials — more secure than account key SAS
NSG inbound: subnet first, then NIC. NSG outbound: NIC first, then subnet. Both must allow
GatewaySubnet, AzureBastionSubnet, AzureFirewallSubnet must use exact these names
VNet peering is non-transitive — A↔B and B↔C does not mean A↔C
Azure Load Balancer = Layer 4. Application Gateway = Layer 7. Traffic Manager = DNS-based global routing
ExpressRoute does not traverse the public internet. VPN Gateway does (encrypted)
Azure File Sync: Storage Sync Service → Sync Group → Cloud Endpoint + Server Endpoint(s)
Azure Policy Deny applies to new resources only — existing resources are flagged as non-compliant but not deleted
App Service deployment slots allow zero-downtime swap (staging → production)
Run Command executes scripts on VMs without SSH/RDP — useful for emergency access
Azure Backup = point-in-time restore. Azure Site Recovery = continuous replication and failover
Diagnostic settings must be configured per-resource — logs don't flow to Log Analytics automatically

✅

Hands-on practice is essential for AZ-104. Create a free Azure account and build: a VM with an NSG, a VNet with peering, a storage account with a lifecycle policy, an App Service with a deployment slot. The exam scenarios make much more sense after you've actually configured these things.

🚀

Next step: After AZ-104, consider AZ-305 (Azure Solutions Architect) for the expert level, or MS-102 (Microsoft 365 Administrator) if you manage Microsoft 365 alongside Azure. Both study guides are coming to Queclouds.

In this guide

Domain 1 — Identities & Governance (15–20%)

Domain 2 — Storage (15–20%)

Domain 3 — Compute (20–25%)

Domain 4 — Networking (20–25%)

Domain 5 — Monitor & Maintain (10–15%)

Exam Day Tips

Quick facts

40–60 questions, 120 minutes

700 / 1000 to pass

Renew annually (free online)

Hands-on Azure experience recommended

Case study questions included

Study tips

Build every topic in the portal — reading alone isn't enough for AZ-104

Domain 3 (Compute) and Domain 4 (Networking) are 40–50% of the exam — spend most time here

NSG rule evaluation order (inbound vs outbound) comes up in multiple questions

Know the exact subnet names for Bastion, Firewall, and Gateway

Other study guides

→ AZ-900 Azure Fundamentals → MS-900 M365 Fundamentals → MS-102 M365 Administrator

📬 Weekly Azure guides

Practical Azure & M365 articles every week. Free.

Associate · MS-102

Microsoft 365 Administrator (MS-102)
Complete Study Guide

MS-102 is the core Microsoft 365 admin certification. This free guide covers all five domains — tenant management, identity, security, compliance, and Microsoft 365 apps. Written for real administrators, not just exam theory.

Exam domains

40–60

Questions

700

Pass score / 1000

Free

This guide

ℹ️

About this guide: MS-102 replaced MS-365 (formerly MS-100 + MS-101 combined). It's a hands-on exam that rewards administrators who actually manage Microsoft 365 tenants. A free trial tenant at admin.microsoft.com is invaluable while you study — many questions make immediate sense once you've seen the admin centres firsthand.

Domain 1

Deploy and Manage a Microsoft 365 Tenant

20–25%

This domain covers everything at the tenant level — setting up a new tenant, managing subscriptions, configuring services, monitoring health, and deploying Microsoft 365 Apps. It's the administrative foundation everything else builds on.

🏢Tenant Configuration and Setup

Microsoft 365 tenant: A dedicated instance of Microsoft 365 services. Every organisation that subscribes gets a tenant with a unique .onmicrosoft.com domain. You add your own custom domains (verified via DNS TXT record).

Custom domains: Add your company domain (e.g. contoso.com) in the Microsoft 365 admin centre → Settings → Domains. Verify ownership by adding a TXT record to your public DNS. After verification, add DNS records for Exchange (MX, Autodiscover), Teams (SIP, lyncdiscover), and other services.

Organisational profile settings: Configure in admin centre → Settings → Org settings: organisation name, technical contact, release preferences (targeted release vs standard release — targeted release gives you new features 2–4 weeks early), password expiration policies.

Microsoft 365 Apps deployment:

Office Deployment Tool (ODT) — XML-based tool for customising and deploying Microsoft 365 Apps to Windows endpoints. Control which apps install, which language, update channel, and whether Outlook is included.
Update channels: Current Channel (monthly, latest features), Monthly Enterprise Channel (monthly, more tested), Semi-Annual Enterprise Channel (twice yearly, most stable — recommended for organisations that need change control)
Microsoft 365 Apps admin centre (config.office.com) — cloud-based management for Microsoft 365 Apps policies, update schedules, inventory, and health.

Microsoft 365 admin centre roles: Key admin roles to know for the exam:

Global Administrator — full access to all admin features. Maximum 5 recommended.
Global Reader — read-only version of Global Admin. For auditors and monitoring.
User Administrator — manage users, groups, and password resets (except Global Admins)
Exchange Administrator — manage Exchange Online including mailboxes, mail flow, and connectors
Teams Administrator — manage Microsoft Teams policies, settings, and meetings
SharePoint Administrator — manage SharePoint Online sites, settings, and storage
Security Administrator — manage security policies in Security & Compliance, Defender, and Entra ID
Compliance Administrator — manage compliance features in Microsoft Purview
Billing Administrator — manage subscriptions, licences, and purchase services
Helpdesk Administrator — reset passwords and manage service requests for non-admin users

📝

Exam tip: Role assignment questions are very common. Know that Helpdesk Administrator can only reset passwords for users who are not admins. User Administrator can reset passwords for users and helpdesk admins. Only Global Admin can reset another Global Admin's password.

📊Monitoring Tenant Health and Service Requests

Service health dashboard: admin.microsoft.com → Health → Service health. Shows current status of all Microsoft 365 services (Exchange, Teams, SharePoint, etc.) — whether they're operating normally, have advisories, or are experiencing incidents. Subscribe to email notifications for services your organisation depends on.

Message centre: admin.microsoft.com → Health → Message centre. Microsoft posts planned changes, new features, and required actions here. Important: messages have action dates — if you miss an action by the deadline, your service may be affected. Filter by service, sort by urgency.

Microsoft 365 usage reports: admin.microsoft.com → Reports → Usage. Shows adoption data: active users per service, email volume, Teams meeting minutes, SharePoint storage used. Available for 7, 30, 90, and 180 day windows. User-level data can be anonymised for privacy compliance (GDPR).

Microsoft 365 Adoption Score: A score (0–800) measuring how effectively your organisation uses Microsoft 365 across people experiences (communication, meetings, content collaboration) and technology experiences (endpoint analytics, network connectivity, Microsoft 365 Apps health).

Support tickets: Raise service requests in the admin centre → Support → New service request. Microsoft provides 24/7 support for all paid subscriptions. Severity A (critical business impact) gets fastest response. You can also run diagnostic checks directly in the admin centre for many common issues.

📱FastTrack and Migration

Microsoft FastTrack is a free onboarding service for customers with 150+ eligible licences. A FastTrack engineer helps you plan and execute the deployment — not doing the work for you, but providing guidance, tools, and best practices.

Migration approaches for Exchange:

Cutover migration — migrate all mailboxes at once. Good for small organisations (<150 mailboxes). DNS MX record cut over after migration completes. Single migration event.
Staged migration — migrate mailboxes in batches. Used when migrating from Exchange 2003/2007 (no hybrid support). Requires Azure AD Connect to sync on-premises AD.
Hybrid migration (Express or Full) — recommended for most organisations. Establish a hybrid connection between on-premises Exchange and Exchange Online. Mailboxes migrated in batches with full coexistence (shared address book, calendar free/busy, mail flow). Users can't tell which system their mailbox is on.
IMAP migration — for migrating from non-Exchange mail systems (Gmail, Lotus Notes, other IMAP servers). Migrates email only — no calendar or contacts.

Domain 2

Implement and Manage Identity and Access

25–30%

The largest domain. Identity is the foundation of Microsoft 365 security. Entra ID, hybrid identity, MFA, Conditional Access, and Privileged Identity Management are all heavily tested with scenario questions.

🔄Hybrid Identity with Entra Connect

Microsoft Entra Connect (formerly Azure AD Connect) synchronises identities from on-premises Active Directory to Entra ID. It's the cornerstone of hybrid identity — enabling the same username and password to work for both on-premises and cloud services.

Authentication methods:

Password Hash Sync (PHS) — hashes of password hashes are synced to Entra ID. Authentication happens in the cloud. Simplest to deploy and maintain. Supports leaked credential detection (Microsoft compares synced hashes against known breached password lists). Works even if on-premises is unavailable.
Pass-through Authentication (PTA) — Entra ID passes the authentication request to an on-premises PTA agent, which validates credentials against AD DS. Passwords never leave the premises. Requires always-on connectivity. Multiple PTA agents recommended for resilience.
Federation with AD FS — authentication redirected to on-premises AD FS servers. Maximum customisation (custom MFA, claims rules) but highest complexity. Most organisations moving away from AD FS toward PHS or PTA.

Entra Connect Health: Monitors the health of your Entra Connect infrastructure — sync errors, agent status, performance metrics. Available in the Entra admin centre under Monitoring → Entra Connect Health. Requires Entra ID P1.

Entra Connect Cloud Sync: A lighter alternative to Entra Connect for simpler scenarios. Runs as an agent on-premises (no sync server needed), configures from the cloud. Supports multi-forest topologies but fewer features than full Entra Connect. Good for organisations with a single forest and straightforward sync requirements.

📝

Exam tip: PHS is the default and recommended auth method. It's the only method that provides leaked credential detection. PTA keeps passwords on-prem. AD FS provides the most customisation. The exam frequently asks which to choose given specific security or compliance requirements.

🛡️Entra ID Authentication Methods and MFA

Authentication methods available:

Microsoft Authenticator app — push notifications, passwordless phone sign-in, TOTP codes. Recommended for most users.
FIDO2 security keys — hardware keys (YubiKey etc). Phishing-resistant, passwordless. Best for frontline workers or high-security scenarios.
Windows Hello for Business — biometric or PIN sign-in on Windows devices. Device-bound, phishing-resistant.
TOTP apps — third-party authenticator apps (Google Authenticator, Authy). Less preferred but supported.
SMS / voice call — one-time codes via text or phone call. Weakest MFA method — SIM swap attacks are possible. Use only when better options aren't available.
Temporary Access Pass (TAP) — time-limited passcode issued by an admin for onboarding new users or recovering account access. User sets up authenticator with TAP, then removes TAP.

Authentication Methods policy (modern): Configure which methods are available to users in Entra admin centre → Protection → Authentication methods. The modern policy replaces the legacy per-user MFA settings and the legacy SSPR authentication methods policy.

MFA registration campaign: Nudge users who haven't registered for MFA to do so at sign-in time. Configure in Entra admin centre → Protection → Authentication methods → Registration campaign. Set a snooze limit (e.g. users can dismiss 3 times before forced to register).

🔒Conditional Access Policies in Depth

Conditional Access evaluates every sign-in attempt and applies policies based on signals. For MS-102 you need to know not just what CA does, but how to configure specific policy scenarios.

Signal types (conditions):

User / group — apply to all users, specific users, groups, or roles
Cloud apps or actions — target specific apps (Exchange Online, SharePoint, Teams, All cloud apps)
Conditions → Sign-in risk — Entra ID Protection risk levels (Low, Medium, High)
Conditions → User risk — based on user behaviour patterns (leaked credentials, impossible travel)
Conditions → Device platform — Windows, iOS, Android, macOS
Conditions → Locations — named locations (IP ranges) or country/region
Conditions → Client apps — browser, modern auth clients, legacy auth clients (Exchange ActiveSync, Other clients)
Conditions → Device filter — based on device attributes (compliant, joined, specific model)

Grant controls:

Require MFA
Require device to be marked compliant (Intune)
Require hybrid Entra ID joined device
Require approved client app (specific Intune-managed apps)
Require app protection policy (MAM policy applied to the app)
Require password change (for high-risk users)
Terms of use acceptance

Session controls (restrict what happens after sign-in):

Sign-in frequency — force re-authentication after X hours regardless of persistent session
Persistent browser session — control whether "Stay signed in?" is shown
App-enforced restrictions — pass device information to Exchange Online or SharePoint to enforce limited experience on unmanaged devices
Conditional Access App Control — route traffic through Microsoft Defender for Cloud Apps for real-time session monitoring

✅

Named locations: Define trusted IP ranges (e.g. your office IP) as named locations. Mark them as trusted. Use in CA policies to require MFA only outside trusted locations — employees don't need MFA at the office but do when working remotely.

👥Entra ID Governance: Access Reviews and Entitlement Management

Access reviews (Entra ID P2) enable periodic reviews of group memberships, application assignments, and role assignments. A reviewer (manager, resource owner, or self-review) confirms whether access is still needed. Automated actions on review completion: remove access, require justification, send reminders.

Common use cases: quarterly review of all guest users, monthly review of Security Administrator role members, annual review of a sensitive SharePoint group.

Entitlement Management (Entra ID P2) provides self-service access request workflows for packages of resources (groups, apps, SharePoint sites). Users request access, approvers approve, access is granted with an expiry. Eliminates ad-hoc email requests for resource access.

Access packages bundle multiple resources together. Example: "Finance Team Access" package includes the Finance security group, the Finance SharePoint site, and a Power BI workspace. New finance employees request this one package instead of three separate requests.

Privileged Identity Management (PIM): Just-in-time activation for Entra ID roles and Azure RBAC roles. Eligible assignments require activation. Activation can require MFA, justification, approval, and is time-limited. Full coverage in the AZ-104 guide — same concepts apply here for M365 admin roles (Global Admin, Exchange Admin, etc.).

💻Device Management with Intune

Microsoft Intune is the MDM/MAM platform used to manage devices accessing Microsoft 365. Full coverage in MS-102 because device compliance feeds directly into Conditional Access.

Device enrollment methods (Windows):

Windows Autopilot — pre-configure devices in hardware vendor's inventory. When user powers on and signs in with their Microsoft 365 account, the device automatically enrols in Intune and configures itself. Zero-touch IT deployment.
Entra ID join + automatic MDM enrolment — user joins device to Entra ID during OOBE (Out of Box Experience). Intune enrolment triggers automatically if MDM authority is set.
Group Policy-driven enrolment — for hybrid Entra ID joined devices. GPO triggers Intune enrolment silently in the background.
Intune Company Portal — users self-enrol personal (BYOD) devices through the Company Portal app. Gets MDM management for full device control.

Compliance policies: Define what "compliant" means (BitLocker enabled, minimum OS version, no jailbreak, PIN required). Devices that don't meet the policy are marked non-compliant. Conditional Access can then block non-compliant devices from accessing Microsoft 365.

Configuration profiles: Push settings to devices — Wi-Fi, VPN, email, restrictions, certificates. Applied automatically when a device enrols and matches the profile's assignment (user group or device group).

App protection policies (MAM): Protect company data within specific apps on personal devices without enrolling the device. Prevent copy/paste from Outlook to personal apps, require PIN for Outlook, remotely wipe only company data when employee leaves.

Domain 3

Manage Security and Threats

25–30%

Security is tested heavily in MS-102. Microsoft 365 Defender, Defender for Office 365, anti-spam, anti-malware, attack simulation, and security scores are all fair game. Know not just what each tool does but how to configure it.

🛡️Microsoft 365 Defender Portal

The Microsoft 365 Defender portal (security.microsoft.com) is the unified security operations centre for Microsoft 365. It consolidates:

Microsoft Defender XDR — correlates alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps into unified incidents
Threat explorer — real-time analysis of threats detected in email (Plan 2 only). Search for emails by sender, recipient, subject, URL, attachment. Perform threat hunting.
Attack simulator — run simulated phishing attacks and password spray campaigns against your users. Measure click rates. Assign training to users who fail.
Secure Score — Microsoft 365 Secure Score measures your security posture (0–100%). Each recommended action increases your score. Use it to prioritise security improvements and track progress over time.
Incidents & alerts — unified incident queue combining signals from all Defender products. Investigate, classify, and respond from one console.

📧Exchange Online Protection (EOP)

Exchange Online Protection is the baseline email filtering layer included with every Exchange Online licence. It protects against spam, malware, and bulk email.

Anti-spam policies: Configure in security.microsoft.com → Email & collaboration → Policies & rules → Anti-spam. Key settings:

Bulk complaint level (BCL) threshold — control what level of bulk email (e.g. newsletters) is treated as spam. Lower number = stricter. 1–3 for strict, 5–7 for standard.
Spam confidence level (SCL) — score assigned to each message. SCL 5–6 = spam, SCL 9 = high confidence spam. Configure what action to take at each level (quarantine, move to junk, delete).
Safe senders/blocked senders — per-policy allow/block lists. Tenant allow/block lists (security.microsoft.com → Tenant Allow/Block Lists) apply globally.
Outbound spam policy — limits per-user email sending rates. When a user account is compromised and sends spam, the outbound limits trigger and the account is restricted. Alerts are sent to security team.

Anti-malware policies: All attachments are scanned. Malware is blocked and quarantined. Configure notification settings (notify admin, not the recipient — notifying the sender teaches attackers that their malware was detected).

Quarantine: Messages filtered as spam, phishing, or malware go to quarantine. Admins can review and release quarantined messages. Users can manage their own spam quarantine (not phishing or malware). Configure quarantine policies to control what users can see and do with quarantined messages.

🔗Defender for Office 365 (Plan 1 and Plan 2)

Plan 1 features (included in Microsoft 365 Business Premium, add-on for E3):

Safe Links — rewrites URLs in emails and Office docs. Scans at click time. If URL weaponised after delivery, blocks it. Configure: rewrite all URLs, scan content in Teams messages, do not allow click-through.
Safe Attachments — detonates attachments in a sandbox. If malicious, blocks the email. Enable Dynamic Delivery to avoid delays.
Anti-phishing (Defender layer) — impersonation protection for users and domains, mailbox intelligence, spoof intelligence. More advanced than EOP baseline.

Plan 2 additional features (included in M365 E5, add-on for E3):

Threat Explorer — real-time email threat hunting and investigation
Attack Simulator — phishing simulations and security awareness training campaigns
Automated Investigation and Response (AIR) — automatically investigates alerts and takes remediation actions (remove malicious emails, block senders) without manual intervention
Threat trackers — curated queries showing trending threats relevant to your organisation
Campaign views — groups related phishing emails into campaigns showing the full attack timeline

📝

Preset security policies: Microsoft maintains two presets — Standard and Strict. Standard is appropriate for most users. Strict is for high-risk users (executives, finance, IT). Assign both simultaneously: Strict to the high-risk group, Standard to everyone else. Strict takes precedence when both apply.

🔍Microsoft Defender for Identity

Defender for Identity (formerly Azure ATP) monitors on-premises Active Directory and Entra ID for identity-based attacks. It analyses Active Directory traffic and event logs to detect:

Reconnaissance — account enumeration, network mapping, LDAP queries
Compromised credentials — brute force, pass-the-hash, pass-the-ticket, Kerberoasting
Lateral movement — remote execution, domain dominance attempts
Domain dominance — DCSync attacks, skeleton key malware, Golden Ticket attacks

Requires a Defender for Identity sensor installed on domain controllers. The sensor monitors AD traffic passively — no agents on user workstations needed.

Alerts surface in the Microsoft 365 Defender portal (security.microsoft.com) alongside other Defender alerts, enabling correlated investigation across email, endpoint, and identity signals.

☁️Microsoft Defender for Cloud Apps (MCAS)

Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility and control over cloud app usage across your organisation.

Key capabilities:

Cloud discovery — analyse firewall/proxy logs to discover all cloud apps in use (Shadow IT). Assess app risk scores. Block or sanction apps through your network controls.
App connectors — API-level integration with sanctioned apps (Microsoft 365, Salesforce, Box, GitHub etc). See all activity, apply DLP policies, detect anomalies.
Conditional Access App Control — proxy sessions between users and cloud apps for real-time control. Block downloads of sensitive files from unmanaged devices. Watermark downloaded documents.
Anomaly detection — impossible travel, mass download, activity from anonymous IP, ransomware activity patterns.
Information protection — apply Microsoft Purview sensitivity labels to files in connected cloud apps.

💡Entra ID Protection

Entra ID Protection (requires P2) analyses billions of sign-in signals to detect compromised accounts and risky sign-ins.

Risk types:

Sign-in risk — probability that the specific sign-in is not by the legitimate user. Signals: anonymous IP, atypical travel, malware-linked IP, unfamiliar sign-in properties, admin confirmed compromise.
User risk — probability that the user account is compromised. Signals: leaked credentials (found on dark web), Entra ID threat intelligence.

Risk policies:

Sign-in risk policy — when sign-in risk is High: block or require MFA. When Medium: require MFA. Built-in to Entra ID Protection or configured via Conditional Access (recommended approach — more flexible).
User risk policy — when user risk is High: require password change. Block access until remediated.
MFA registration policy — require all users (or a specific group) to register for MFA within X days of first sign-in.

Risky users and risky sign-ins are surfaced in the Entra admin centre → Protection → Risky users and Risky sign-ins. Admins can dismiss risk (if investigation shows false positive) or confirm compromise (marks user as compromised, triggers higher-risk classification).

Domain 4

Manage Compliance

10–15%

Microsoft Purview compliance tools — information protection, DLP, retention, eDiscovery, and audit. Smaller domain but the questions are precise — know the difference between similar-sounding features.

🏷️Microsoft Purview Information Protection

Sensitivity labels classify and protect content. Labels can apply encryption, content markings (headers, footers, watermarks), and restrict what users can do with the content.

Label scope:

Files & emails — applied to Word, Excel, PowerPoint, Outlook emails. Can encrypt and restrict forwarding.
Groups & sites — applied to Microsoft 365 Groups, Teams, and SharePoint sites. Controls privacy (public/private), guest access, external sharing.
Schema assets — applied to data in Azure Purview (for data governance).

Auto-labelling policies: Automatically apply labels to content containing sensitive information types (credit card numbers, NHS numbers) — either as a recommendation ("This looks like sensitive content — apply label?") or automatically without user involvement. Server-side auto-labelling scans SharePoint and OneDrive at rest.

Encryption settings: When a label applies encryption, you configure who can decrypt (specific users, groups, or authenticated users), what they can do (view only, view and edit, full control), and whether offline access is permitted and for how long.

🔏Data Loss Prevention (DLP)

DLP policies detect and protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, and endpoint devices.

Sensitive information types (SITs): Pre-built patterns (regex + validation) for common sensitive data. Microsoft provides 200+ built-in SITs. You can create custom SITs using regex patterns, keyword lists, and confidence levels.

Trainable classifiers: Machine learning models that identify content by context, not just patterns. Built-in examples: Resume, Source Code, Tax, Financial Statements, Healthcare. Used when pattern-matching (regex) isn't sufficient — e.g. identifying internal project documents or customer communications.

DLP policy mode:

Simulation (audit-only) — runs silently, logs matches, no user impact. Use for 1–2 weeks before enabling enforcement.
Turn it on — active enforcement. Block with override, block without override, or restrict based on conditions.

Endpoint DLP: Extends DLP to Windows 10/11 and macOS endpoints. Prevents sensitive data from being copied to USB drives, printed, uploaded to personal cloud apps, or shared via Bluetooth. Requires onboarding devices into Defender for Endpoint.

🗂️Records Management and Retention

Retention policies (location-based) apply to all content in a scope: all Exchange mailboxes, all SharePoint sites, all Teams channels. Set once, forget.

Retention labels (item-level) are applied to individual items — either manually by users or automatically. Labels can declare content as a record (cannot be modified or deleted by users during the retention period) or a regulatory record (even admins cannot delete — for the most strict regulatory requirements).

Disposition review: When a retention label's retention period expires, instead of automatic deletion you can trigger a review. Reviewers are notified, examine the content, and decide: dispose (delete), relabel, or extend retention. Creates a full audit trail of the disposition decision.

Preservation Lock: When applied to a retention policy or label policy, it cannot be turned off, shortened, or deleted until the retention period expires. Required for FINRA, SEC 17a-4, and other regulations requiring immutable record retention. One-way action — cannot be reversed.

🔎eDiscovery and Audit

Content search — search across Exchange mailboxes, SharePoint sites, OneDrive, Teams chats, and Viva Engage for content matching keywords, date ranges, or senders. Export results to PST or as individual files.

eDiscovery (Standard) — includes content search plus the ability to place content on legal hold (preserves content even if a user deletes it) and export for legal review. Available in most M365 plans.

eDiscovery (Premium) — adds custodian management (track people involved in a case), near-duplicate detection, email threading (group related emails), attorney-client privilege detection, and smart tag suggestions. Requires E5 or E5 Compliance add-on.

Legal hold vs retention policy: Legal hold (in an eDiscovery case) preserves content for a specific legal matter — indefinitely, or until the hold is removed. Retention policies preserve content for a fixed period for compliance. Both can coexist — preservation lock from eDiscovery takes precedence.

Audit (Standard): Records user and admin activity across Microsoft 365 — sign-ins, file access, mailbox access, admin actions. Retained for 90 days. Search the audit log in compliance.microsoft.com → Audit.

Audit (Premium): Longer retention (up to 1 year, extendable to 10 years with add-on licence), high-value audit events (when email was read, not just received — MailItemsAccessed), higher bandwidth access to the API. Requires E5 or E5 Compliance.

Domain 5

Manage Microsoft 365 Apps and Services

15–20%

Exchange Online administration, SharePoint and OneDrive management, Teams policies, and collaboration settings. These are the day-to-day admin tasks — practical hands-on knowledge is the best preparation here.

📧Exchange Online Administration

Mailbox types:

User mailbox — standard mailbox associated with a licensed user account
Shared mailbox — accessed by multiple users without a dedicated licence (up to 50GB). Used for helpdesk@, info@, reception@ addresses. Users added as Full Access or Send As delegates.
Resource mailboxes — Room mailboxes (meeting rooms) and Equipment mailboxes (projectors, cars). Can auto-accept meeting requests based on availability. Managed via Exchange admin centre → Resources.
Archive mailbox — additional storage for older emails. Appears as a secondary mailbox in Outlook. Enable per-user in Exchange admin centre → Mailboxes. Users can move or set rules to auto-archive items.

Mail flow rules (transport rules): Conditions + Actions applied to messages in transit. Common uses: add legal disclaimers, block external forwarding, add recipients to all outbound emails, apply sensitivity labels, route through compliance journal.

Accepted domains: Domains that Exchange Online will accept mail for. Three types: Authoritative (Exchange is the final destination), Internal relay (some recipients may be elsewhere — hybrid), External relay (Exchange relays to another mail system).

Email address policies: Define the email address format for users in your organisation (e.g. [email protected]). Applied automatically as users are created or updated.

Address lists and Global Address List (GAL): The GAL is the directory of all recipients visible in Outlook's address book. Address lists are subsets of the GAL (e.g. by department or location). Hidden from address list: mailboxes and groups with "Hide from Exchange address lists" checked — still receive email, just not visible in the GAL.

📝

Litigation Hold vs In-Place Hold: Litigation Hold is the simple, blanket hold — preserves all mailbox content indefinitely. In-Place Hold is query-based — preserve only items matching specific criteria (keywords, date range, senders). Both are configured in the Exchange admin centre.

🗂️SharePoint Online and OneDrive Administration

SharePoint admin centre (admin.microsoft.com → SharePoint):

Sites — view, create, delete, and restore site collections. Configure storage quotas per site. Set sharing settings (who external users can share with).
Policies → Sharing — tenant-wide sharing controls. Most restrictive settings: "Only people in your organisation." Most permissive: "Anyone" (anonymous links). Individual site settings can be more restrictive but not more permissive than the tenant setting.
Policies → Access control — block unmanaged devices from downloading files (only browser access), restrict access by IP location, set session timeout for unmanaged devices.
Content services → Term store — managed metadata taxonomy used across SharePoint for consistent tagging and classification.

SharePoint storage: Default 1TB + 10GB per licence. Can purchase additional storage. Shared across all site collections — no per-site quota by default (you can set one).

OneDrive admin settings: Configure default storage per user (1TB default, can set higher for E plans), sync client restrictions (only sync to domain-joined devices), retention of deleted accounts' OneDrive (default 30 days before permanent deletion — configurable up to 10 years).

Microsoft 365 Groups expiration: Set expiration period (e.g. 180 days). Group owners are emailed to renew. Unrenewed groups are soft-deleted. Restoreable for 30 days. Reduces SharePoint and Teams sprawl.

💬Microsoft Teams Administration

Teams admin centre (admin.teams.microsoft.com):

Teams policies (assigned to users or groups):

Teams policy — whether users can create private channels, shared channels, discover teams
Meeting policy — who can bypass lobby, allow cloud recording, maximum meeting size, live captions, whiteboard, PowerPoint Live
Messaging policy — read receipts, delete/edit sent messages, priority notifications, Giphy, memes, stickers
App permission policy — which apps (Microsoft, third-party, custom) users can add to Teams
App setup policy — which apps are pinned in the Teams sidebar for users
Calling policy — private calling, call forwarding, simultaneous ring, voicemail

Teams Phone: Cloud-based PBX functionality. Requires Teams Phone licence. Options for PSTN connectivity: Microsoft Calling Plans (buy minutes from Microsoft), Operator Connect (use your telco's SIP trunks), Direct Routing (connect your own SBC to Teams).

Live events: Broadcast to up to 20,000 attendees (higher with Teams Premium). Requires producer, presenters, and attendees. One-way broadcast — attendees watch but don't interact directly.

Teams Rooms: Purpose-built meeting room devices (Surface Hub, Logitech Tap, Poly). Require Teams Rooms licence (Basic free for limited features, Pro for full features). Managed centrally from Teams Rooms Pro Management portal.

Exam Day

Strategy and What to Expect

🎯Exam Format

Questions: 40–60. Mix of multiple choice, multiple select, case studies, drag-and-drop, and build list
Duration: 120 minutes (plus 20 minutes admin time)
Passing score: 700 out of 1000
Cost: ~£165 / $165 USD
Validity: 1 year, renewable via free online assessment
Recommended experience: 1+ year as a Microsoft 365 administrator

📋Top 15 Things to Know

PHS is the recommended authentication method — the only one that detects leaked credentials
PTA passes auth to on-premises AD — passwords never leave the premises
Helpdesk Admin resets passwords for non-admins only. User Admin can reset helpdesk admin passwords. Only Global Admin resets Global Admin passwords.
Conditional Access requires Entra ID P1 — Security Defaults are free but mutually exclusive with CA
Named locations mark trusted IPs — use to require MFA only outside the office
Defender for Office 365 Plan 1 = Safe Links + Safe Attachments + anti-phishing. Plan 2 adds Threat Explorer + Attack Simulator + AIR.
Preset security policies: Strict overrides Standard when both apply to the same user
Sensitivity labels encrypt content — scope determines where they apply (files, sites, assets)
Auto-labelling: client-side (recommendation/automatic in apps) vs server-side (scans SharePoint/OneDrive at rest)
Endpoint DLP requires devices onboarded to Defender for Endpoint
Litigation Hold = all mailbox content, indefinitely. In-Place Hold = query-based, specific content.
Audit (Standard) = 90 days. Audit (Premium) = 1 year (+ up to 10 years with add-on).
SharePoint sharing: tenant setting is the maximum. Site settings can only be more restrictive.
OneDrive deleted account retention: 30 days default, configurable up to 10 years
Teams Phone PSTN options: Calling Plans (Microsoft), Operator Connect (telco), Direct Routing (your SBC)

✅

Best advice: Spend time in the compliance.microsoft.com and security.microsoft.com portals — many MS-102 questions show you a screenshot or describe a UI and ask what to configure. Hands-on familiarity cuts your answer time in half and reduces mistakes from similar-sounding options.

🚀

You've covered all four study guides available on Queclouds. AZ-900 → MS-900 → AZ-104 → MS-102. For the next level, AZ-305 (Azure Solutions Architect Expert) is coming soon. Subscribe to the newsletter to be notified when it drops.

In this guide

Domain 1 — Tenant Management (20–25%)

Domain 2 — Identity & Access (25–30%)

Domain 3 — Security & Threats (25–30%)

Domain 4 — Compliance (10–15%)

Domain 5 — M365 Apps & Services (15–20%)

Exam Day Tips

Quick facts

40–60 questions, 120 minutes

700 / 1000 to pass

Renew annually (free online)

Hands-on M365 experience recommended

Replaces MS-100 + MS-101

Study tips

Domains 2 and 3 are 50–60% of the exam — spend most time on Identity and Security

Use a free M365 developer tenant at developer.microsoft.com/en-us/microsoft-365/dev-program

Know every admin role and exactly what they can/cannot do

Understand the difference between PHS, PTA, and AD FS authentication

Other study guides

→ MS-900 M365 Fundamentals → AZ-900 Azure Fundamentals → AZ-104 Azure Administrator

📬 Weekly M365 guides

Practical Azure & M365 articles every week. Free.

Feature	AD DS (Active Directory)	Microsoft Entra ID
Where it runs	Your on-premises domain controllers	Microsoft's cloud (no servers to manage)
Authentication protocols	Kerberos, NTLM	OAuth 2.0, OIDC, SAML 2.0
Organisational structure	OUs, GPOs, Sites	Groups, Administrative Units
Device management	Domain join + Group Policy	Entra join + Intune MDM
Primary query method	LDAP	Microsoft Graph API (REST/JSON)
Built-in MFA	No (requires RADIUS or AD FS)	Yes, native
Conditional Access	No	Yes (requires P1 licence)
Works on personal devices	Limited (requires VPN or hybrid join)	Yes, fully supported
SaaS app sign-on (SSO)	Only via AD FS federation	Native SSO to 3,000+ apps

Option	What happens	Use when
Delete items automatically	Items are permanently deleted after the retention period	You need automatic disposal (most compliance scenarios)
Trigger a disposition review	Reviewers are notified to manually approve deletion	High-value records needing human sign-off before deletion
Do nothing (retain only)	Items are kept but never automatically deleted	You only need a minimum keep — no max retention

Role	Read	Create/modify	Delete	Grant access	Use for
Owner	✓	✓	✓	✓	Platform engineers, subscription administrators
Contributor	✓	✓	✓	✗	Developers, DevOps engineers managing a resource group
Reader	✓	✗	✗	✗	Auditors, monitoring teams, new joiners
User Access Administrator	✓	✗	✗	✓	Teams responsible for access management without resource management

Master Azure & Microsoft 365 the right way.

Everything Microsoft cloud,covered in depth.

Start reading

Azure Resource Manager explained: a complete guide for IT admins and developers

Conditional Access policies: a step-by-step setup guide

Microsoft Sentinel: deploy your first workspace in 30 minutes

Exchange Online mail flow rules explained: transport rules, connectors, and best practices

Deploy Azure infrastructure with Bicep: zero to working template

Built for real Microsoft cloud practitioners.

Pass your Microsoft exam.Study free.

From the blog

Trusted by Microsoft cloud practitioners.

Stay ahead of the Microsoft cloud.

Azure Fundamentals (AZ-900)Complete Study Guide

Describe Cloud Concepts

Describe Azure Architecture and Services

Describe Azure Management and Governance

Exam Strategy & Tips

Microsoft 365 Fundamentals (MS-900)Complete Study Guide

Describe Cloud Concepts

Describe Microsoft 365 Apps and Services

Describe Security, Compliance, Privacy, and Trust

Describe Microsoft 365 Pricing and Support

Exam Strategy & Tips

Azure Administrator (AZ-104)Complete Study Guide

Manage Azure Identities and Governance

Implement and Manage Storage

Deploy and Manage Azure Compute Resources

Implement and Manage Virtual Networking

Monitor and Maintain Azure Resources

Strategy, Tips, and What to Expect

Microsoft 365 Administrator (MS-102)Complete Study Guide

Deploy and Manage a Microsoft 365 Tenant

Implement and Manage Identity and Access

Manage Security and Threats

Manage Compliance

Manage Microsoft 365 Apps and Services

Strategy and What to Expect

Entra ID vs Active Directory: what's actually different and why it matters

The one-sentence version

Where each one lives and what it manages

Protocols: Kerberos vs OAuth 2.0

OUs and Group Policy vs Groups and Intune

Synchronising the two: Entra Connect

Three ways to join a device

Which do you need?

How to configure Microsoft 365 email retention policies with Purview

What retention actually does under the hood

Where to configure: Microsoft Purview Compliance Portal

Step 1: Create the retention policy

Name and description

Policy type: Static vs Adaptive

Locations

Retention settings

Step 2: Test before enforcing (simulation mode)

Step 3: Enable the policy

Retention labels vs retention policies: when to use each

Monitoring and troubleshooting

Azure RBAC explained: roles, scopes, and least-privilege access design

How RBAC works: the three-part model

Scope inheritance: the most important concept

The four essential built-in roles

Service-specific roles: always prefer them over Contributor

Managed identities: RBAC without credentials

Groups over individuals: the only way to scale

Custom roles: use sparingly

Designing a least-privilege model in practice

Setting up Microsoft Teams governance: naming policies, expiry, and guest access

Why Teams governance matters

Controlling who can create Teams

Naming policies

Prefix and suffix rules

Blocked words

Expiration policies

Guest access controls

Tenant-level Teams guest settings

Entra ID B2B settings

Access reviews for guests

Teams policies for users

Azure Cost Management: how to set budgets, alerts, and spot waste early

Master Azure &
Microsoft 365
the right way.

Everything Microsoft cloud,
covered in depth.

Pass your Microsoft exam.
Study free.

Azure Fundamentals (AZ-900)
Complete Study Guide

Microsoft 365 Fundamentals (MS-900)
Complete Study Guide

Azure Administrator (AZ-104)
Complete Study Guide

Microsoft 365 Administrator (MS-102)
Complete Study Guide