- 12 hours ago
- 7 min read
Build practical Azure administration skills with 28 structured AZ-104 labs covering Azure CLI, PowerShell 7, Bicep, break/fix exercises, machine-readable validation, 1,250 assessment questions, and safety-first cleanup.
Why I built this environment
Preparing for AZ-104 can easily turn into a collection of disconnected demos, copied commands, and resources that remain billable after the lesson ends. A command may complete successfully without proving that the resulting configuration is correct. A cleanup command may also return successfully while soft-deleted, shared, or unexpectedly scoped resources remain behind.
I wanted a more operational learning loop: begin with a read-only preflight, understand the ownership and cost boundary, make an explicit change, validate it independently, investigate a controlled failure, clean up, and prove that the environment is no longer active.
The result is the AZ-104 Complete Learning Environment: a command-first curriculum that moves from a safe bootstrap through identity, governance, storage, compute, networking, monitoring, backup, recovery, and two end-to-end capstones.
All Azure operations are performed with Azure CLI, az rest, Bicep, AzCopy, or KQL from PowerShell 7. The repository intentionally contains no Azure Portal walkthroughs or Portal screenshot requirements. Architecture diagrams explain each topology, while machine-readable validation output provides evidence after a learner performs a live run.
The project at a glance
| Measure | Included | |---|---:| | Standalone learning environments | 28 | | Guided domain labs | 25 | | Foundation labs | 1 | | End-to-end capstones | 2 | | Assessment questions | 1,250 | | Official objective bullets mapped | 82 | | Catalog study time | Approximately 57 hours | | Supported execution style | Azure CLI hosted in PowerShell 7 | | Current repository status | Offline-validated |
Labs 01–25 each contain 50 original four-option questions mapped back to the related task and objective. Lab 00 and Capstones 26–27 remain hands-on only.
At the reviewed repository revision, I ran the release validator:
python tools/validate_repository.py --release
The result was 219 checks passed, zero warnings, and zero failures. That validates the repository contract, schemas, generated-content consistency, question counts, architecture synchronization, lifecycle fixtures, links, and secret markers. It does not pretend that Azure resources were deployed during that offline check.
Coverage aligned to the current AZ-104 blueprint
The curriculum maps the Microsoft skills measured as of April 17, 2026. Microsoft currently divides AZ-104 into five weighted domains and recommends hands-on experience across Azure administration tooling. Because certification objectives change over time, the repository records its blueprint version and source-verification date rather than treating the mapping as permanent. Microsoft AZ-104 study guide
| AZ-104 domain | Labs | Questions | Current exam weight | |---|---|---:|---:| | Manage Azure identities and governance | 01–05 | 250 | 20–25% | | Implement and manage storage | 06–09 | 200 | 15–20% | | Deploy and manage Azure compute resources | 10–16 | 350 | 20–25% | | Implement and manage virtual networking | 17–21 | 250 | 15–20% | | Monitor and maintain Azure resources | 22–25 | 200 | 10–15% | | Foundation and capstones | 00, 26–27 | Hands-on | Supporting coverage |
The objective map connects all 82 objective bullets to primary labs and reinforcing capstone tasks.
What the 28 labs cover
Foundation
Lab 00 establishes a safe local and Azure context: tool checks, subscription selection, cost gates, state handling, resource ownership, and residual cleanup.
Identity and governance
Labs 01–05 cover Microsoft Entra users and groups, licenses, guest users, self-service password reset, Azure RBAC scopes, resource hierarchy, tags, locks, Azure Policy, budgets, cost management, and Advisor.
Storage
Labs 06–09 cover storage account security, redundancy, encryption, keys, network restrictions, scoped SAS access, Blob tiers and lifecycle management, versioning, object replication, AzCopy, Azure Files, snapshots, soft delete, and identity-based access.
Compute
Labs 10–16 cover ARM and Bicep lifecycle, virtual machines, disks, host encryption, availability, scale sets, mobility, Azure Container Registry, Azure Container Instances, Azure Container Apps, and App Service scaling, slots, TLS, DNS, backup, and networking.
Networking
Labs 17–21 cover virtual networks, subnets, peering, public IPs, user-defined routes, NSGs, ASGs, effective rules, service endpoints, private endpoints, Azure DNS, Bastion, Load Balancer, and Network Watcher.
Monitoring and recovery
Labs 22–25 cover Azure Monitor metrics, logs, KQL, Insights, alert rules, action groups, alert processing, Azure Backup, restore operations, reporting, and Azure Site Recovery failover.
Capstones
Lab 26 asks the learner to build a governed, secure, observable Azure workload. Lab 27 focuses on operating, troubleshooting, backing up, and recovering it. The capstones reinforce the earlier teaching instead of replacing the detailed domain labs.
The anatomy of every lab
Each lab is a portable folder with the same recognizable contract:
a real-world scenario, learner role, outcome, and completion criteria;
five objective-linked checkpoints;
an editable Mermaid architecture source and accessible SVG;
explicit inputs, permissions, regional constraints, and cost gates;
read-only preflight checks;
guided Azure CLI commands in PowerShell blocks;
positive and negative validation;
a deterministic break/fix exercise;
a job-style optional challenge;
dependency-aware cleanup and a residual-resource audit;
synchronized Preflight.ps1, Setup.ps1, Validate.ps1, and Cleanup.ps1 scripts;
solution notes and offline contract tests;
an assessment with task-level remediation in Labs 01–25.
The README is the complete guided lane. The lifecycle scripts are a synchronized automation lane. If you complete both, use different run IDs so the state and ownership records cannot collide.
A safety-first lifecycle
The central design is this operating loop:
Read-only preflight
↓
Preview the exact change and ownership boundary
↓
Explicit execution
↓
Independent positive and negative validation
↓
Deterministic break/fix and repair
↓
Machine-readable evidence
↓
Preview cleanup → execute cleanup → residual audit
Setup.ps1 and Cleanup.ps1 preview by default. Azure mutations require -Execute. Moderate and elevated cost paths require -AcknowledgeCost, and tenant-wide changes require a separate -AcknowledgeTenantChange gate.
Resources are associated with a run ID and tagged where Azure supports tags. Cleanup reads the recorded resource IDs, checks ownership, follows declared dependencies, and reports retained or soft-deleted objects rather than silently calling the job complete.
That distinction matters: an Azure budget alerts you about spending; it does not stop resource consumption. The curriculum therefore treats cleanup as a learning objective, not a final footnote. Microsoft cost-management guidance
Command-first by design
PowerShell 7 is the command host, while Azure operations use:
Azure CLI and az rest;
Bicep through az bicep;
AzCopy for storage data movement;
KQL for Azure Monitor investigation;
Python for schemas, generators, and repository validation;
Node.js and Material for MkDocs for the searchable documentation site.
This is intentionally different from a Portal-first course. Reproducible commands make inputs, scopes, expected state, and failure output easier to review and repeat. However, Microsoft’s current audience profile also recommends Azure Portal experience. This repository should complement—not replace—Portal practice, Microsoft Learn, current product documentation, and the official practice assessment. Microsoft Certified: Azure Administrator Associate
Three learning pathways
The same labs support three routes.
Quick start
Complete readiness and Lab 00, then sample one environment from each major domain: Labs 01, 06, 10, 17, and 22. Finish with the build capstone when you are ready to combine the skills.
Full exam preparation
Complete Labs 00–25 in order, use each 50-question assessment as a review gate, and finish with both capstones. The repository includes an eight-week study plan for this route.
Job-ready practice
Complete the full path, but also perform every break/fix and optional operational challenge. For each checkpoint, be able to explain the permission boundary, billable resource, independent proof, likely failure signal, and safe deletion order.
Start safely
Use a disposable environment that you are authorized to modify. The repository currently expects PowerShell 7.4+, Azure CLI 2.88+, Bicep 0.46.1+, AzCopy 10.32.8+, Python 3.12, Node.js 22, and Git. The dev container offers a reproducible alternative.
git clone https://github.com/Jamonygr/az104-azure-administrator-labs.git
Set-Location az104-azure-administrator-labs
# Install pinned project dependencies and run local-only readiness checks.
./tools/Initialize-LabEnvironment.ps1 `
-InstallDependencies `
-OfflineOnly
# Authentication is deliberate and separate.
az login
az account show --output table
# Run the blocking readiness report for Lab 00.
./tools/Initialize-LabEnvironment.ps1 -LabId LAB-00
The initializer creates ignored local configuration and state. It does not authenticate, silently install software, change the active subscription, register providers, or deploy Azure resources unless the corresponding explicit option and later lab execution are used.
Before running a lab, read its permission and cost gates. West Europe and North Europe are defaults in the repository, not availability guarantees. Quota, SKUs, licenses, tenant roles, provider states, and regional features vary between subscriptions.
Evidence without leaking the environment
The canonical live evidence is the JSON produced by the independent validation and cleanup stages under the ignored .state/<run-id>/ directory.
Public evidence should contain only the minimum safe result: date, tool versions, region, pass/partial/fail state, cleanup state, and residual count. Tenant and subscription IDs, UPNs, object IDs, resource IDs, IP addresses, tokens, passwords, access keys, connection strings, SAS values, billing details, and unrelated inventory must be removed.
Architecture diagrams are instructional visuals. They are not presented as proof that a deployment ran.
Assessment and remediation
The 1,250 questions are not copied exam items or an exam dump. They are original learning checks attached to the task and objective that teach the concept.
Each assessment-enabled lab uses this mix:
15 foundational questions;
25 applied questions;
10 advanced questions.
Missed answers route the learner back to the relevant lab task. The goal is not to memorize a letter position; it is to repeat the configuration, validation, or troubleshooting boundary that the question exposed.
Current validation status
The repository deliberately separates two meanings of validation:
Offline-validated means its schemas, metadata, generated content, lifecycle scripts, diagrams, assessment bank, fixtures, local links, and safety contracts pass automated checks.
Live-verified means a separately approved Azure run completed the guided path, break/fix exercise, independent validation, cleanup, and residual-resource audit in a disposable environment.
Every catalog entry currently reports offline-validated. The blog therefore does not claim that all 28 Azure environments have been deployed successfully. That status can change only when real, redacted evidence exists.
Who this is for
This environment is useful for:
learners preparing for Exam AZ-104 who want structured hands-on repetition;
administrators who prefer reproducible commands over disconnected Portal clicks;
engineers who want to practise preflight, permissions, break/fix, validation, and cleanup;
trainers looking for objective-linked exercises and original assessment material;
contributors interested in maintaining a schema-driven Azure curriculum.
It is not an official Microsoft course, a guarantee of passing the exam, a substitute for current Microsoft documentation, or permission to experiment in a production tenant.
Microsoft updates exams periodically and updates the English version first. Always compare the repository blueprint with the current AZ-104 study guide before scheduling the exam.
Open source and contributing
The code and documentation are available under the MIT License. Contributions should preserve the safety contract, first-party sourcing, original assessment content, generated-file consistency, and honest validation status.
Final thoughts
The most valuable part of an administration lab is not the create command. It is understanding the scope, proving the expected result, recognizing failure, repairing it, and leaving the environment clean.
That is what this project is built around. Twenty-eight environments and 1,250 questions provide the breadth, but the repeated operating discipline—preflight, preview, execute, validate, break/fix, clean up, audit—is the real curriculum.
Comments