Microsoft Revises AZ-104 Exam: Governance and Identity Take Center Stage Starting April 2026

Microsoft has updated the AZ-104 Azure Administrator certification with a revised study guide effective April 17, 2026. The refresh reshapes the exam blueprint to emphasize identity management, governance, cost controls, and cross-service operational awareness—skills that mirror the real-world shift from managing isolated Windows servers to running policy-driven cloud infrastructure.

For the growing number of Windows administrators eyeing Azure, the change is more than an exam tweak. It signals that cloud administration in 2026 is no longer just about spinning up virtual machines; it’s about controlling sprawl, enforcing compliance, and treating identity as the foundation of every action.

The April 2026 Blueprint: What’s Different

Microsoft’s latest AZ-104 study guide, effective for exams taken on or after April 17, 2026, restructures the certification around the role of an Azure administrator who implements, manages, and monitors an organization’s cloud environment. While compute and networking remain critical, the big shift is the formal elevation of governance and identity to co-equal footing.

The new skills outline—publicly documented by Microsoft—assigns 20 to 25 percent of the exam weight to “Manage Azure identities and governance.” That domain covers Microsoft Entra users and groups, role-based access control (RBAC), Azure Policy, resource locks, management groups, tags, cost alerts, and Azure Advisor recommendations. Monitoring and maintenance account for another 10 to 15 percent, with the remainder split across networking, storage, and compute.

For context, earlier versions of AZ-104 gave identity and governance a smaller, more siloed treatment. The revised weighting makes it clear: you cannot pass—or competently administer Azure—without understanding how to architect boundaries before you deploy a single workload.

Why Governance Now Comes Before Virtual Machines

Traditional Windows administration starts with the server: build it, join it to Active Directory, apply Group Policy, and hand it over. In Azure, the first questions are about scope and control. Which subscription hosts the workload? Which resource group contains it? Who can change it, and under what policy guardrails?

The exam now tests candidates on these questions. Microsoft expects familiarity with Azure Policy assignments that can audit, deny, or modify resource configurations, and with resource locks that prevent accidental deletions. Tagging—once treated as a housekeeping afterthought—is now examined alongside cost budgets and Advisor alerts because financial visibility is an operational duty, not just a procurement concern.

For a Windows admin, this is the most consequential mental pivot. A cloud resource can be technically functional yet administratively unacceptable: a storage account with public access enabled, a VM without a backup policy, or a resource group missing mandatory tags might work perfectly yet violate security, audit, or chargeback rules. AZ-104 now bakes that governance mindset into every domain.

Identity: The New Control Plane for Azure Ops

If governance sets the rules, identity enforces who can do what. The exam’s identity domain goes deep into Microsoft Entra ID (the rebranded and expanded Azure Active Directory) as the mechanism that governs nearly every administrative action. Candidates must understand how Entra ID determines access to the portal, PowerShell, Azure CLI, and the resource management API—and how RBAC roles apply at management-group, subscription, resource-group, or resource level.

The “where” matters. Granting Reader access to a single resource group is worlds apart from granting Contributor across a production subscription. The exam requires administrators to recognize not only which role grants access but whether the scope is appropriate. It also expects familiarity with inherited permissions, guest users, managed identities, and self-service password reset—concepts that bridge the gap between legacy Active Directory and cloud-native identity.

For organizations running hybrid setups, the crossover is immediate. Active Directory still underpins Windows authentication, domain-joined VMs, and legacy apps, but Entra ID increasingly governs the cloud control plane. A Windows admin who understands both can troubleshoot the messy middle ground where a user can sign in but can’t manage a resource, or a service runs but can’t retrieve data.

Breaking Down the Exam Domains: A Windows Admin’s Cheat Sheet

The revised AZ-104 organizes skills into five weighted domains. Here’s how they stack up and what they mean for someone coming from an on-premises Windows background:

Notice that compute, networking, and identity/governance now carry nearly identical weight. The exam no longer allows candidates to lean on server expertise alone; it forces a balanced understanding of how these layers interact. A VM, for example, depends on a subnet, network security group, managed disk, backup policy, and RBAC assignment—all while being subject to Azure Policy and budget alerts.

From Active Directory to Entra ID: A Practical Transition

For Windows professionals used to Group Policy and domain trusts, Azure governance tools are conceptually familiar but operationally different. Azure Policy acts as a cloud-native enforcement engine that can audit and remediate configurations at scale, much like GPOs, but it applies to the resource lifecycle itself. A policy can block an invalid deployment before it ever creates a non-compliant resource.

Resource locks similarly mirror the mindset of protecting organizational units from accidental changes. Tags replace custom AD attributes as the tool for ownership and chargeback. The learning curve is real, but the AZ-104 update accelerates it by baking these comparisons into the exam. Microsoft’s own four-day course (AZ-104T00-A) now spends significant time on subscriptions, identity, and infrastructure administration before touching networking or VMs.

What This Means for IT Career Paths

The certification’s broader operational scope makes it a strategic credential for Windows administrators, infrastructure engineers, and technical consultants. It doesn’t turn a generalist into a network architect or security specialist overnight, but it teaches enough operational vocabulary to work alongside those roles in a cloud team.

Think of a routine request: “Deploy a Windows Server 2025 VM for an internal app.” The apparent task is simple. The administrator, however, must weigh network segmentation, private DNS, backup retention, encryption keys, cost tagging, RBAC scoping, and policy compliance—all before hitting “create.” The new AZ-104 prepares candidates to see that full picture, not just the VM icon.

Career paths that benefit include Azure Administrator, Cloud Engineer, Systems Administrator, IT Operations Engineer, and Cloud Support Specialist. With the April 2026 refresh, the exam also better aligns with role expectations for hybrid and multi-cloud environments where governance and identity are the consistent threads.

Preparing for AZ-104: A Hands-On Roadmap

Passing the exam requires more than memorizing the portal. Microsoft recommends hands-on experience, and the updated blueprint makes that advice essential. Here’s a targeted preparation path for Windows admins:

• Build a sandbox subscription. Use separate resource groups for dev and test. Practice with Azure Policy, resource locks, and tags from day one.
• Recreate a familiar workload. Migrate a small AD domain to Entra ID Connect, deploy a domain-joined VM, and configure private access to an Azure Files share.
• Test the governance layer. Create a policy that denies public IPs, then try to deploy a VM with a public IP. Observe the denial and learn how to remediate.
• Set up monitoring and recovery. Configure alerts on VM CPU spikes, enable backup, perform a test restore, and then tear down the environment cleanly.
• Use official Microsoft Learning paths. The AZ-104T00-A course and Microsoft Learn modules align directly with the new skills outline.

The goal is not to memorize what each menu item does but to internalize the cloud-administration lifecycle: plan, deploy, secure, observe, recover, and retire. That sequence, repeated in a lab, is what separates a certified operator from someone who can pass a test.

The Bigger Picture: Azure in 2026 and Beyond

The April 2026 update arrives as Azure continues adding managed AI services, Kubernetes enhancements, and higher-level abstractions. The tools will evolve, but the core administrative duties—identity, governance, connectivity, resilience, and accountability—remain constant. By elevating governance and identity, AZ-104 signals that cloud administration is no longer a checkbox activity; it’s a policy-driven discipline.

Windows administrators who invest in this certification now will find themselves better equipped to manage not just Azure but any modern platform that treats policy and identity as first-class citizens. That includes hybrid endpoints, SaaS suites, and even on-premises systems that are increasingly managed through cloud consoles. The exam update may feel like a tougher climb, but for those who make it, the view from the top is a lot clearer.