Microsoft Azure — AZ-104 Administrator Track
From AZ-900 fundamentals to AZ-104 admin-grade Azure. VNets, Storage, Compute, Identity, Backup, Monitor — production-ready.
Who Is This For
- System / network admins moving to cloud
- Engineers targeting AZ-900 + AZ-104
- DevOps engineers managing Azure subscriptions
- Cloud architects building Azure landing zones
Prerequisites
- Basic IT and networking
- Free Azure account (we walk through setup)
Full Syllabus — 14 Modules
M 1Cloud Concepts & AZ-900 Recap
- IaaS / PaaS / SaaS
- Regions, Availability Zones, geographies
- Subscriptions, Management Groups
- Pricing & cost tools
M 2Resource Manager, Resource Groups & ARM
- ARM model
- Resource Groups & tags
- Locks & Policy
- ARM templates & Bicep intro
M 3Identity — Entra ID (Azure AD)
- Tenants, users, groups, devices
- Custom domains, MFA, conditional access basics
- SSPR, password protection
- RBAC overview
M 4RBAC & Governance
- Built-in vs custom roles
- Scope & assignment
- Azure Policy & Initiatives
- Blueprints (legacy) & landing zones
M 5Virtual Networks (VNet)
- VNet, subnets, address space
- NSG & ASG
- VNet peering, hub-spoke
- User-defined routes (UDR)
M 6Hybrid Connectivity
- VPN Gateway — point-to-site, site-to-site
- ExpressRoute basics
- Virtual WAN
- DNS — Private DNS Zones, Azure DNS
M 7Compute — VMs & VMSS
- VM creation, sizing, images
- Availability Sets, Availability Zones, VMSS
- Scaling rules
- Disk types, snapshots
M 8Containers & PaaS
- App Service basics
- Container Instances
- AKS — high level
- Function Apps
M 9Storage Accounts
- Account types, redundancy (LRS / ZRS / GRS)
- Blob, File, Queue, Table
- Lifecycle, soft delete
- Access keys, SAS, AAD-based access
M 10Load Balancing — LB / App Gateway / Front Door
- Public vs Internal LB
- Application Gateway with WAF
- Front Door & CDN
- Traffic Manager
M 11Backup, DR & Site Recovery
- Recovery Services Vault
- Backup policies — VM, files, SQL
- Azure Site Recovery (ASR)
- RPO / RTO planning
M 12Monitoring & Alerts
- Azure Monitor, Metrics, Alerts
- Log Analytics & KQL basics
- Application Insights
- Network Watcher
M 13CLI, PowerShell, Cloud Shell, Bicep
- Azure CLI primer
- PowerShell Az module
- Cloud Shell
- Bicep basics for IaC
M 14Cert Path & Interview Prep
- AZ-104 blueprint walk-through
- Mock exam strategy
- L2 / L3 cloud admin interview question bank
What You Get
40 Hours
Live + recorded for the AZ-104 blueprint.
Hands-on Labs
Free-tier Azure account — you build VNets, VMs, App Services, Backup live.
Real Case Studies
Hub-spoke design, hybrid VPN, App Gateway WAF, ASR DR.
Interview Q&A
L2 / L3 cloud question bank.
Certificate
Techclick Infosec course completion certificate.
WhatsApp Group
Doubt-clearing batch group with the trainer.
Your Instructor
Trained by working senior cloud and network security engineers with 13+ years of hands-on enterprise experience across Microsoft Azure, AWS, hybrid cloud and large-scale enterprise migrations.
Career Outcomes — Who Hires AZ-104 Engineers
Microsoft Azure is the second-largest public cloud globally and the most common cloud platform in Indian enterprises that also run on-prem Active Directory, Exchange or .NET workloads. That overlap is exactly why an AZ-104 administrator is one of the most consistently hired cloud roles in the country.
Companies that consistently recruit Azure administrators out of Indian metros include the big system integrators (TCS, Infosys, Wipro, HCLTech, Tech Mahindra, LTIMindtree, Capgemini, Cognizant, Accenture), the Big-4 advisory practices (Deloitte, PwC, EY, KPMG), captive GCCs (Microsoft itself, JPMorgan, Goldman Sachs, Wells Fargo, American Express, Standard Chartered, HSBC, Citi, RBS, Maersk), Indian banks running Azure landing zones (Kotak, HDFC, Axis, IndusInd), and a long tail of mid-market product companies that started on Azure because of their Microsoft 365 / Entra ID footprint.
The typical entry job titles we see graduates land into are Cloud Administrator, Azure Engineer L1/L2, Site Reliability Engineer (Azure), Cloud Infrastructure Analyst, DevOps Engineer (Azure track) and Cloud Migration Consultant. By 18–24 months these typically progress to L3 cloud admin or solution architect tracks.
Indicative salary bands (India, 2026)
- Fresher / 0-1 yr post-AZ-104: ₹4.5 - 7.5 LPA
- L2 cloud admin (2-4 yrs): ₹8 - 14 LPA
- L3 / Senior cloud engineer (5-8 yrs): ₹16 - 28 LPA
- Azure Solution Architect (8+ yrs, AZ-305): ₹30 - 55 LPA
Bands above are the median range we see in offers our students accept across Gurugram, Bengaluru, Pune, Hyderabad and Mumbai. GCCs and product companies routinely pay 20-40% above these numbers; service companies anchor around the lower end. Numbers move every year — treat them as directional, not promise.
Sample Interview Questions We Drill
Every batch goes through three live mock interviews. These are real questions our alumni have been asked at Indian GCCs and SI panels — the same kind we coach you to answer crisply, in your own words, with a story from the lab work in this course.
Q 1A VM in subnet A can't talk to a VM in subnet B — how do you debug?
Walk the four-layer story: VM NIC NSG → subnet NSG → route table (UDR + system routes) → peering / firewall in the path. Use Network Watcher's IP Flow Verify and Connection Troubleshoot. Most candidates skip the route table — don't.
Q 2Difference between Availability Set, Availability Zone and VMSS?
Availability Set protects within one datacentre (fault + update domains). Availability Zone protects across datacentres in one region. VMSS is about scale and identical VM management, not redundancy. Combine VMSS with zones for both.
Q 3When would you choose a Storage Account access key vs SAS vs Entra ID auth?
Access key = full control, share it and the blast radius is the entire account. SAS = time-bound, scope-bound, can be revoked by rotating the signing key. Entra ID = identity-based, auditable, MFA-enforceable — pick this when the caller has an identity.
Q 4How would you design hybrid connectivity for a 5-branch enterprise to Azure?
Hub-and-spoke VNet topology, hub holds Azure Firewall + VPN/ExpressRoute Gateway, each branch lands an S2S VPN (or ExpressRoute for the HQ). Spokes per app/env, peered to hub, UDR forces all internet traffic via the firewall. Cover this in module 6.
Q 5What's the difference between Azure Policy and RBAC?
RBAC = who can do what (assignment of role to identity at a scope). Azure Policy = what is allowed to exist (resource shape, location, tags, SKU). RBAC denies actions; Policy denies non-compliant configurations. You need both.
Q 6Recovery Services Vault — what does the storage redundancy choice cost you?
LRS = cheapest, single-zone, fine for dev. ZRS = cross-zone in region. GRS = cross-region with read-access option. Once a vault has backups, you cannot change redundancy — make the call at vault creation.
Where AZ-104 Sits in the Microsoft Cert Path
AZ-104 is the foundation. Once you finish this track, the natural next steps depend on which direction you want to go:
- Security track: Azure Security (AZ-500) → then SC-100 for cybersecurity architect roles.
- SOC / SIEM track: Microsoft Sentinel SC-200 for SOC analyst roles built on Azure log analytics + KQL.
- Architect track: AZ-305 Azure Solutions Architect Expert (requires AZ-104).
- DevOps track: AZ-400 DevOps Engineer Expert (requires AZ-104 or AZ-204).
- Hybrid identity track: SC-300 Identity & Access Administrator — heavy on Entra ID, the bit you touch in module 3 here.
Most of our students who complete AZ-104 take AZ-500 next; the security premium on salary bands is the highest single jump you can make from this base.
FAQ
Q 1Free trial enough?
Yes for most labs. We avoid expensive resources or auto-clean them after exercises.
Q 2AZ-900 first?
Optional. Module 1 recaps the AZ-900 essentials.
Q 3AZ-104 aligned?
Yes. Module 14 walks the blueprint with mocks.
Q 4Duration?
About 40 hours over 5–6 weeks.
Q 5After AZ-104?
You can take our Azure Security (AZ-500) or Microsoft Sentinel SIEM track next.
Become an Azure Administrator.
Talk to us about the next batch.