AZ-104 jobs: which roles to apply for, and the Azure administrator interview

Job titles to search instead of only "Azure administrator"

The exact title "Azure administrator" is a small slice of the work that uses the AZ-104 skill set. Search these as well:

• Cloud support engineer or technical support engineer (Azure). Ticket-driven work troubleshooting customer environments, at Microsoft's support vendors, partners and hosting companies. The most fresher-friendly title on this list.
• Microsoft 365 and Azure administrator, or systems administrator with Azure in the description. Small and mid-sized employers rarely split identity, M365 and Azure into separate jobs.
• Junior cloud engineer or cloud operations engineer at a Microsoft partner or MSP.
• Service desk analyst (Microsoft 365), where Entra ID user and licence work is the daily job and Azure tickets arrive once you show you can handle them.

Use the skills as search terms too: "Entra ID", "Intune", "Azure Virtual Desktop", "Bicep". Many postings list tools and never name the exam.

On remote work: there is no public dataset that measures what share of Azure admin postings are remote, so treat any percentage you read with suspicion. In practice, MSP and partner roles that manage many customer tenants are the ones most often run remotely, while hybrid roles that still include on-site servers usually are not.

Who hires AZ-104 holders, and why partners care about your certificate

Three kinds of employer account for most AZ-104 roles. Companies already running Microsoft 365 that are moving servers into Azure need someone who understands both identity and infrastructure. Managed service providers run many customers' tenants at once, so you get breadth fast and learn under ticket pressure. Microsoft partners sell Azure projects and resell licences.

Partners have a measurable reason to hire you. Microsoft's Solutions Partner designations for Azure score a partner's skilling by counting certified people. On the enterprise track for Infrastructure, at least two people must hold Azure Administrator Associate before any skilling points count, and each certified individual can contribute up to four points. A partner short of certified staff has a business reason to interview someone with the credential and limited experience. Mention in your cover note that your certification is current and verifiable on Microsoft Learn; the hiring manager will know why that matters.

What AZ-104 jobs pay, and what the salary surveys are measuring

Skillsoft's list of top-paying IT certifications for 2025 puts the average US salary of Azure Administrator Associate holders at $148,849. Read the respondent profile before quoting that number to yourself: average age 40, an average of 24 certifications each, 52 percent in management, and "cloud architect" as the most likely job role. It is the pay of experienced people who also hold AZ-104, and it says little about a first Azure job.

The Bureau of Labor Statistics figure for network and computer systems administrators is a steadier reference: a median of $99,130 in May 2025 across 323,600 jobs. BLS projects that occupation to decline 4 percent from 2025 to 2035, while still expecting about 13,400 openings a year from people retiring or changing jobs. BLS does not publish a separate figure for cloud administrators. For a first offer, expect the support and junior engineer end of the market and negotiate from there; negotiating an entry-level offer covers how, and the cloud certification salary guide compares credentials.

Renewal, verification and the link to send an employer

Microsoft associate certifications expire annually. Renewal is free: you pass an online assessment on Microsoft Learn during a six-month eligibility window before expiry, and a pass extends the certification one year from the expiration date. The assessment is shorter than the exam, unproctored and open book, and you can retake it as many times as you need before the deadline. Fundamentals certifications such as AZ-900 do not expire. An expired AZ-104 also stops counting toward a partner's designation, which removes one of the reasons they would hire you.

Employers verify through your Microsoft Learn profile. From the Transcript page, "Share link" generates a URL showing your earned credentials; certifications you have earned carry an "Online Verifiable" tag, and the profile must be public for a shared credential to verify. Put that link on your resume and in your LinkedIn featured section. Adding certifications to LinkedIn covers placement, and whether employers check certifications covers what happens on their side.

The adjacent-role route if you have no IT job yet

AZ-104 for freshers works best as a lever inside a first job, not as the thing that gets it. Microsoft's own audience profile for the exam assumes familiarity with operating systems, networking, servers and virtualisation, plus experience with PowerShell, Azure CLI, ARM templates or Bicep and Entra ID.

The route that works: take a service desk or M365 support role at an employer or MSP that runs Azure. Do the Entra ID user, group and licence tickets well. Ask for the Azure tickets nobody wants, such as cost reports, backup failures or NSG change requests. Within a year you have Azure work on your resume with a real employer's name attached, and that is what moves you to the administrator title. The help desk interview guide covers the first step.

In parallel, build one project you can show: a hub-and-spoke network deployed from a Bicep file, with an NSG, Azure Bastion, a backup policy and a budget alert, all torn down after each session to keep the bill near zero. Cloud projects that get interviews has the build list. If you are weighing Azure against AWS for this route, the AWS and Azure comparison sets out which employers lean which way.

Azure administrator interview questions: identity and governance

Identity and governance carry 20 to 25 percent of the AZ-104 exam weighting, and they open most interviews because every other mistake in Azure starts with the wrong person having the wrong access.

Tested: whether you understand hybrid identity, which most employers run. AD DS is a domain service built on Kerberos and LDAP, with organisational units and Group Policy. Entra ID is a cloud identity provider using web protocols such as SAML, OAuth 2.0 and OpenID Connect, with a flat structure and no Group Policy. A strong answer then covers how they connect: Entra Connect Sync or Cloud Sync synchronises users, with password hash sync, pass-through authentication or federation for sign-in. Mention Entra Domain Services for legacy apps that need LDAP or Kerberos in Azure.

Tested: least privilege. Roles can be assigned at management group, subscription, resource group or resource scope, and assignments inherit downward. Owner can do everything including assign access; Contributor can manage resources but cannot grant access; Reader can view; User Access Administrator manages access only. Strong candidates add that Entra roles such as Global Administrator are a separate system from Azure RBAC, and that standing Owner rights should be replaced with just-in-time elevation through Privileged Identity Management where the licence allows.

Tested: governance thinking. RBAC controls who can perform an action. Azure Policy controls what state resources are allowed to be in, whoever creates them. An Owner can still be blocked by a policy that denies public IP addresses or restricts regions. Name effects such as Deny, Audit, Modify and DeployIfNotExists, and mention initiatives for grouping policies.

Tested: practical cost management. Tag resources by owner and cost centre so spend is attributable. Set budgets with alerts in Cost Management, and say clearly that a budget alerts but does not stop resources. Act on Azure Advisor recommendations, schedule auto-shutdown on dev VMs, rightsize, delete orphaned disks and public IPs, and consider reservations or savings plans for steady workloads.

Networking questions

Tested: layered network security. An NSG is a stateful layer 3 and 4 filter on a subnet or network interface, with rules evaluated by priority from 100 to 4096 and default rules at 65000 and above that you can override but not delete. Azure Firewall is a managed, centralised firewall with application rules for FQDNs, threat intelligence filtering, NAT and central logging, usually placed in a hub network with user-defined routes sending traffic through it. The strong answer uses both: NSGs for segmentation close to the workload, the firewall for egress control and inspection.

Tested: hub-and-spoke design. Peering connects virtual networks over the Microsoft backbone, in the same region or globally, with no public internet or gateway in the path. Address spaces must not overlap. Peering is not transitive: if spoke A and spoke B both peer with a hub, A cannot reach B without a firewall or network virtual appliance in the hub and routes pointing at it, or Azure Virtual Network Manager connectivity. Mention gateway transit, which lets spokes use the hub's VPN or ExpressRoute gateway.

Compute, storage and recovery questions

Tested: matching redundancy to risk and cost. LRS keeps copies within a single datacenter in the primary region; Microsoft rates it at least 11 nines of annual durability and it is the cheapest. ZRS copies synchronously across three or more availability zones, at least 12 nines. GRS adds asynchronous replication to the paired secondary region, at least 16 nines, with read access to the secondary only if you choose RA-GRS. The point that separates candidates: redundancy is not backup. Microsoft's documentation states that deletions and overwrites apply to all copies at once.

Tested: failure domains. An availability set spreads VMs across up to 3 fault domains (shared power and network) and up to 20 update domains (maintenance groups) inside a datacenter, and two or more VMs in a set qualify for a 99.95 percent SLA. Availability zones are physically separate datacenters in a region, so they also survive the loss of a whole datacenter. Microsoft now recommends Virtual Machine Scale Sets with flexible orchestration for high availability.

Tested: operational scale. Centrally managed, consistent VMs that scale out and in on metrics or a schedule, spread across zones or fault domains. Mention the two orchestration modes, uniform and flexible, and that autoscale needs a sensible minimum, a maximum and a cool-down to avoid flapping.

Tested: recovery thinking. Backup keeps point-in-time copies with retention, so you can restore after deletion, corruption or ransomware. Site Recovery continuously replicates VMs to another region so you can fail over in a disaster. Most production systems need both, because replicating a corrupted disk to a second region just gives you two corrupted disks.

Troubleshooting scenarios, including for experienced candidates

Tested: method when the report is vague. Start broad and narrow down. Is the VM running, and what do Resource Health and boot diagnostics show? Check effective security rules, remembering that an NSG on the subnet and one on the NIC both apply. Run IP flow verify or connection troubleshoot in Network Watcher. Check whether a new user-defined route sends traffic through a firewall that drops it. Look at the Activity log for whatever changed this morning. Then the guest: Windows Firewall, the RDP service, using Run Command or the serial console if you cannot get in. Finish by recommending Azure Bastion so RDP is not exposed to the internet at all.

Tested, mostly for experienced candidates: working within governance. Read the error for the policy assignment name, find it in Azure Policy, and read its effect and parameters. Then decide whether the template is wrong (fix it) or the case is a justified exception (request a scoped exemption with an expiry from whoever owns the policy). Disabling the assignment yourself is the wrong answer even if your role allows it.

The AZ-104 exam page lists the full skills outline, and if your next interview is for a design role, the AZ-305 architect exam is where those questions come from.