Microsoft AZ-104: What Azure Administrators Do After Certification

Passing Microsoft AZ-104 can establish that a candidate understands how to implement and manage common Azure resources. It does not mean the candidate has already lived through an expired certificate, a broken private endpoint or a failed restore window at 2:00 AM. The real administrator’s job is to turn those capabilities into a service that other people can use safely, predictably and without needing to know who configured every resource.

Microsoft Certified: Azure Administrator Associate is built around operations: identity and governance, storage, compute, networking, monitoring and recovery. Candidates should understand the scope of the certification, but the more useful career question is how those responsibilities look over a normal week. A cloud administrator is part implementer, part troubleshooter and part custodian of access, availability and cost.

Access requests require more than a role assignment

A new team member needs to view a storage account’s monitoring results, but does not need to delete blobs or change networking rules. The administrator identifies the principal, scope and least-privileged role. The team then tests access in the service where the work actually occurs. It is tempting to assign Contributor because it makes a portal error disappear; doing so changes the risk for all resources at that scope.

Another request sounds similar but is actually about Microsoft Entra directory administration rather than Azure resource access. The administrator must distinguish Entra directory roles from Azure RBAC and recognize that Azure Policy can deny a resource deployment even if a user has broad RBAC permission. Access reviews, time-bounded privileges and clear resource ownership prevent a one-off support ticket from becoming a permanent excess permission.

Incidents begin with a symptom, not a favorite service

Consider a ticket that reads, ‘The payroll app times out after the network maintenance window.’ A useful operator gathers the actual hostname, affected region, resolved address, request path, effective routes, NSG rules and service metrics. If the application has a private endpoint, DNS may still resolve to a public address even though a peering connection reports Connected. Restarting the VM won’t fix a name resolution error.

Similarly, an application that receives 403 from Azure Blob Storage may have a healthy network path and a valid identity, but no Blob Data permission. By identifying the failed control plane—identity, service authorization, DNS, routing, storage or application logic—the administrator can make the smallest corrective change and explain why it worked. A durable incident record includes the failing test, evidence, intervention and verification.

Routine changes need an observable outcome

An administrator may deploy a new App Service version, update storage lifecycle rules or change virtual-machine capacity. The job is not complete when Azure reports that the operation succeeded. The change must meet a particular service need and leave the environment operable. That means a known target, reviewed configuration difference, controlled rollout, health verification and rollback plan where supported.

Infrastructure as code helps make changes reproducible, but it also magnifies mistakes if a template targets the wrong subscription or resource group. A safe change begins with the current resource state and permissions, then reviews the proposed difference and plans how to detect an unintended result. Resource locks, Azure Policy and RBAC are complementary protections; none substitutes for a responsible change process.

Monitoring is a response plan, not a wall of dashboards

A chart showing CPU utilization is useful only if it helps the team answer a question. What customer symptom does it represent? Does a metric alert need an action group? Should an alert processing rule temporarily suppress notifications during planned maintenance? Which logs reveal the operation that failed? An Azure administrator aligns metric signals, diagnostic settings, Log Analytics queries and incident ownership around service behavior rather than collecting every possible chart.

Good operations also consider telemetry cost and retention. A verbose diagnostic configuration can generate unnecessary expense without helping anyone resolve incidents. Agree on useful evidence and an owner, then verify that the right team actually receives and understands a test alert. Observability is only effective when the organization can act on the information.

Recovery readiness must be demonstrated

Backups can report success while the restored application is unusable. A practical administrator schedules an authorized restore test, verifies data integrity and application dependencies, and records the elapsed recovery time. For a workload with a stricter availability objective, Azure Site Recovery or another continuity design may be necessary; that question must be answered from business RPO and RTO requirements, not the popularity of a service.

Test restore paths in a disposable or otherwise approved environment. Capture which permissions and network services the restored workload requires, what the recovery owner must decide and what evidence constitutes success. The organization needs usable recovery documentation, not an optimistic screenshot of a backup job.

Make cost and governance someone’s everyday responsibility

Azure budgets and cost alerts can detect spending patterns, but they are not a technical cap on usage. Administrators should understand how App Service plans, disks, redundant storage, logging and unused public IPs contribute to costs. A routine review of tags, resource ownership and unused capacity can prevent surprises. A cost-reduction change should still be tested against service-level and recovery requirements.

When a budget alarm appears, first determine which resource or workload is responsible, what changed, and whether reducing cost compromises required performance or data durability. A technically working configuration that violates an operational or financial constraint is not necessarily the right solution.

Build a portfolio that resembles the job

A useful administrator portfolio is not a gallery of Azure portal screenshots. Document three short cases: a resource-access failure diagnosed to the correct role or scope; a network issue traced through DNS, routing and filtering; and a backup or release rollback exercise with a measurable result. State the original requirement, failed hypothesis, evidence, fix and final verification for each case. These records are easier for a hiring manager to evaluate than a claim to know ‘all Azure services.’

The related end-to-end Azure administrator capstone gives a controlled way to connect these skills. The main lesson is career-wide: certification introduces a professional standard, but trustworthy administration is the repeated ability to diagnose, change and recover an environment responsibly.

• Category: Others