AZ-104 hands-on labs and study plan: pass it by building, not memorizing

Most AZ-104 study plans are reading lists with a practice test stapled to the end. This one is different: six to eight weeks where every exam domain is anchored to something you actually build in a real subscription — plus an honest account of the part labs cannot cover, and how not to run up a bill doing it.

New to cloud? CAMPUX is a free, build-first course. Start here →

Yes — you can pass AZ-104 in six to eight weeks at roughly eight hours a week if you anchor every exam domain to something you actually build, then drill practice questions on top. Hands-on alone will not carry you: the exam also tests portal detail and service limits you only meet in drills.

That first sentence is the whole plan in miniature, so let me unpack the assumption before anything else. Eight hours a week is the pace I see working people actually sustain — two weeknight sessions and one longer weekend block. If you can only manage five, stretch the plan to ten or eleven weeks rather than skipping the builds; the builds are the part that makes the rest stick. If you have a free month and no job, you can compress it, but most people reading this do not, so the plan below assumes six focused weeks of domain work and up to two weeks of drilling and review at the end.

I passed my own admin-level exams the slow, wrong way first — flashcards, video courses on 1.5x speed, and a head full of facts that evaporated the moment a question described a scenario instead of asking a definition. What finally worked was flipping the order: build the thing, break the thing, and only then read the documentation, which suddenly reads like a description of something you have touched rather than a wall of nouns. Everything below is that method applied to AZ-104, using the free CAMPUX classes and the public labs repo, so you can run the entire plan without paying anyone — including us.

The exam, weighted honestly

AZ-104 (Microsoft Azure Administrator) covers five domains. The weightings below are the ones on the official skills outline as I write this in September 2026 — but Microsoft adjusts weightings and reshuffles objectives periodically, so check the official AZ-104 page on Microsoft Learn before you book. Treat the ranges as a budget for your attention, not gospel.

Notice what the weights are telling you. Identities-and-governance plus compute is up to half the exam. Networking is smaller by weight but punches far above it in difficulty, because networking questions describe a topology and ask you to predict what traffic does — you cannot pattern-match your way through them. Monitoring is the smallest domain and the one people skip, which is a mistake, because its questions are among the most answerable if you have ever actually written a KQL query.

The plan at a glance

One row per week. Each week has three legs: a free class (the concept), a lab you build (the experience), and a drill (the exam-shaped detail). The labs live on-site and in the public repo at github.com/kloudcaptain/campux-labs; the drills are the free question bank at exam practice. If you have never set up an Azure account or the CLI, do the setup lab before week one — it costs nothing and saves you an evening of yak-shaving later.

Week by week, with the point of each build

Week 1 — Identities: who can do what

Start with Entra ID, subscriptions and groups, because everything else in Azure hangs off this skeleton: tenants contain subscriptions, subscriptions contain resource groups, and identity decides who touches any of it. Then build the RBAC with security groups lab — create users, put them in groups, assign roles to the groups instead of the people, and verify the access actually works. The exam loves the seams here: the difference between an Entra role and an Azure RBAC role, and how a role assigned at a subscription flows down to every resource group inside it. You will not confuse those two after you have granted the wrong one and watched it do nothing.

Week 2 — Governance: guardrails that outrank people

The RBAC and Azure Policy class covers the idea that policy beats permission — a user with Owner rights still cannot create a resource that policy denies. Prove it to yourself in the policy-as-code lab: write a policy that blocks a region or forces a tag, deploy it, then try to violate it and read the error. Finish with the short resource locks lab — locks are a tiny topic that shows up on the exam out of proportion to their size, and the behavior of a delete lock versus a read-only lock is exactly the kind of thing you remember forever after a read-only lock breaks a deployment you thought was harmless.

Week 3 — Storage: tiers, redundancy, and access

Read the storage accounts class, then do the first Bicep storage lab — you will deploy a storage account as code, which quietly teaches you two exam topics at once, because AZ-104 also expects you to read ARM/Bicep templates. While the account exists, poke at the parts the exam asks about: switch a blob between hot, cool, and archive tiers, generate a SAS token and note what it can and cannot do, and look at which redundancy options the portal offers you and which it greys out. That greyed-out menu is a preview of a question you will meet later.

Week 4 — Compute: VMs the hard way, containers the modern way

The compute class walks the ladder from IaaS VMs to containers to serverless. For the build, do two things. First, create one VM entirely by hand in the portal — deliberately, slowly, reading every blade — because AZ-104 still asks portal-level VM questions about sizes, disks, and availability options, and this is the one place I recommend clicking over coding. Second, run the Container Apps and ACR lab to see the modern path: push an image to a registry, run it as a managed container app, and scale it. Availability sets versus zones versus scale sets is the classic question cluster here; you will keep them straight once you have seen where each choice appears during creation.

Week 5 — Networking: the domain that decides your margin

This is the week to protect. Study virtual networks and subnets, then build the hub-and-spoke lab — two spoke networks peered to a hub, with NSGs controlling what can reach what. Then do the thing tutorials never make you do: break it. Add a deny rule and watch a connection die; note that Azure reserves five addresses in every subnet when your math comes up short; observe that peering is not transitive when a spoke tries to reach another spoke. Exam networking questions are little murder mysteries about traffic, and the only reliable preparation is having been at the crime scene.

Week 6 — Monitoring and backup: the domain everyone skips

Finish with the Azure Monitor and Log Analytics class and the observability lab, where you write real KQL against real logs — after which the exam's KQL snippets read like plain English. Then run the backup and restore a file share lab, because backup questions are pure experience questions: what a Recovery Services vault contains, what soft delete actually protects you from, and how a restore behaves. This domain is only 10–15% of the exam, but it is the cheapest 10–15% to secure, and in the actual job it is half of what an administrator does all day.

Weeks 7–8 — Drill, review, rebuild

Now flip the ratio: mostly questions, targeted rebuilding. Run full-length timed sets on the free question bank, and after each set, sort your misses by domain rather than by question. A miss usually means one of two things — a concept you never built (go rebuild that lab from memory, no notes) or a detail you never drilled (make a note and drill it). Book the exam for the end of week 8 before you feel ready. In my experience nobody feels ready; the date is what converts studying into finishing.

The honest gap: hands-on alone does not pass AZ-104 either

Here is the section the build-everything crowd skips, and I am part of that crowd, so it costs me something to write it. You can be genuinely competent in an Azure subscription and still fail this exam. I have watched it happen. The reason is that AZ-104 tests two different things and only one of them is competence.

The first thing is understanding — can you reason about scope inheritance, predict what an NSG does, pick the right redundancy option. Labs build that, and it is most of the exam. The second thing is recall of administrative trivia: which storage redundancy options can convert to which, the limits on subnets and peerings, which VM operations require deallocation, what moves with a resource and what breaks when you move it. You can run labs for a month and never brush against most of those, because real work does not require holding limits in your head — the portal or the error message tells you. The exam takes the error message away.

Labs teach you to think in Azure. Drills teach you to answer in Microsoft. The exam requires both, in that order.

So the honest formula is sequence, not either/or: build first, so the majority of questions become reasoning you can do live, then drill until the trivia layer sticks. Doing it in the other order — question banks first — is how people memorize 400 answers and still panic at a scenario question phrased a new way. If you are wondering whether you can skip the building and just do Microsoft Learn modules plus drills, I wrote up whether Microsoft Learn is enough for AZ-104 separately, and the short answer is: enough to pass, sometimes; enough to be worth hiring, rarely.

And one hedge on the other side: passing AZ-104 does not make you employed, either. It gets you past a filter. What gets you through an interview is being able to talk through things you built — which is the quiet second reason this plan is build-first. The same six weeks that prepare you for the exam leave you with a small portfolio of deployments, and if you have no job to get experience from, that matters more than the badge; there is a whole note on getting Azure experience with no job if that is your situation.

If you want this plan with an instructor in the room

Everything above is free and self-paced on purpose — verify the teaching quality yourself before you trust anyone's paid program, including ours. That said, if you already know that self-paced means self-abandoned for you, the live cohort runs this same build-first method over 2.5 months with a live instructor, and AZ-104 territory is roughly the first half of it. One mention, no hard sell; the classes and labs linked in this article are the same material either way.

Questions people also ask

Are hands-on labs enough to pass AZ-104?

No, and I say that as someone who teaches build-first. Labs give you the mental model that makes most questions easy, but AZ-104 also tests details you rarely meet while building: which replication options a storage account tier supports, subnet limits, what moves with a resource group and what does not. The winning order is build first, then drill practice questions until the trivia sticks. Labs alone leave points on the table; question banks alone leave you unable to reason through scenario questions. You need both.

How many hours should I study for AZ-104?

Plan for roughly 50 to 80 hours if you already know cloud basics — that is the six-to-eight-week plan here at about eight hours a week. If you are coming in cold with no Azure exposure at all, add two or three weeks of fundamentals first. People do pass faster, and plenty take longer; the hours matter less than whether each domain got both a build and a drill. Treat any fixed number, including mine, as a planning assumption, not a promise.

Can I do AZ-104 labs on the Azure free tier?

Mostly, yes. A new Azure account comes with credit for the first 30 days and a set of always-free services, and most AZ-104 labs — identities, RBAC, policy, storage accounts, small VMs, virtual networks, monitoring — fit inside that if you are disciplined. The discipline is the point: put every lab in its own resource group, delete the group at the end of every session, and set a budget alert on day one. The resources that quietly cost money are the ones you forget, not the ones you use.

What is the hardest domain on AZ-104?

For most people it is networking. Virtual networks, subnets, peering, NSG evaluation order, routing, and load balancing are the areas where guessing fails, because the questions describe a topology and ask what traffic actually does. The fix is to build one: peer two virtual networks, break the connectivity with an NSG rule, and trace why. Identities and governance is the other one that punishes skim-reading — scope inheritance and the difference between Entra roles and Azure RBAC roles show up constantly.

Do I need AZ-900 before AZ-104?

No — there is no prerequisite, and Microsoft does not require AZ-900 first. If you have any IT background or you are willing to spend the first week or two on fundamentals, going straight to AZ-104 is fine and saves an exam fee. AZ-900 makes sense if you are brand new to cloud and want a gentler on-ramp, or if your employer pays for it anyway. Passing AZ-900 first does not shorten the AZ-104 work much; the overlap is smaller than people expect.