Microsoft Microsoft Azure Administrator AZ-104 Exam Dumps: Updated Questions & Answers (July 2026)

User1 can resize VM1. Yes, this is correct. According to the tables, User1 is assigned the Contributor role at the subscription level for Sub1. The Contributor role grants full access to manage all resources in the subscription, including the ability to resize virtual machines1. Therefore, User1 can resize VM1, which is a resource in RG1 under Sub1.

User2 can create a new storage account in RG1. No, this is not correct. According to the tables, User2 is assigned the Reader role at the resource group level for RG1. The Reader role grants read-only access to view existing resources in the resource group, but not to create, update, or delete any resources2. Therefore, User2 cannot create a new storage account in RG1.

User3 can assign User1 the Owner role for RG3. No, this is not correct. According to the tables, User3 is assigned the Storage Account Contributor role at the resource group level for RG3. The Storage Account Contributor role grants full access to manage storage accounts and their data in the resource group, but not to assign roles to other users3. To assign roles to other users, User3 would need a role that has Microsoft.Authorization/roleAssignments/write permissions, such as User Access Administrator or Owner4. Therefore, User3 cannot assign User1 the Owner role for RG3.

In Microsoft Azure, Azure Resource Manager (ARM) templates are JSON-based files used to define and automate the deployment of Azure resources in a consistent and repeatable manner. To deploy an ARM template, the PowerShell cmdlet you use depends on the deployment scope — whether the template targets a tenant, management group, subscription, or resource group.

According to the Microsoft Azure Administrator documentation (AZ-104 Study Guide, “Deploy and Manage Azure Resource Manager Templates”):

New-AzTenantDeployment → Used for tenant-level deployments, typically involving management group creation or tenant-wide policies.

New-AzSubscriptionDeployment → Used for subscription-level deployments, when resources are created directly under the subscription rather than within a resource group.

New-AzResourceGroupDeployment → Used for resource group-level deployments, which is the most common scenario for creating and managing resources such as virtual machines, storage accounts, and virtual networks.

New-AzDeployment → An older alias that may refer to subscription-level deployments in older Az modules but is not the standard for resource group deployments.

In this question, the ARM template defines both a resource group and a storage account that will be deployed within that resource group. Therefore, the correct PowerShell cmdlet to use is:

New-AzResourceGroupDeployment `

-ResourceGroupName < RGName > `

-TemplateFile < PathToTemplateFile >

This cmdlet processes the specified ARM template file, validates the schema, and provisions all the resources defined in the template inside the target resource group.

Hence, based on the Azure Resource Manager official documentation and exam objectives, the correct answer is:

A deny assignment prevents users from modifying or deleting resources, even if they have RBAC permissions. Microsoft explicitly documents that deny assignments are automatically created and managed by Azure deployment stacks.

Azure Policy enforces compliance but does not create deny assignments. ARM templates deploy resources but cannot create deny assignments directly. Landing zones are architectural patterns, not enforcement mechanisms.

Microsoft documentation states:

“Deployment stacks create and manage deny assignments to prevent unauthorized changes to managed resources.”

To create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2, you need to create two additional load balance resources: a frontend IP address and a health probe.

A frontend IP address is the IP address that the clients use to access the load balancer. It can be either public or private, depending on the type of load balancer. A frontend IP address is required for any load balancing rule1.

A health probe is used to monitor the health and availability of the backend instances. It can be either TCP, HTTP, or HTTPS, depending on the protocol of the load balancing rule. A health probe is required for any load balancing rule1.

A backend pool is a group of backend instances that receive the traffic from the load balancer. You already have a backend pool that contains VM1 and VM2, so you don’t need to create another one.

An inbound NAT rule is used to forward traffic from a specific port on the frontend IP address to a specific port on a backend instance. It’s not required for a load balancing rule, but it can be used to access individual instances for troubleshooting or maintenance purposes1.

A virtual network is a logical isolation of Azure resources within a region. It’s not a load balance resource, but it’s required for creating an internal load balancer or connecting virtual machines to a load balancer2.

 Users: Admin1 and Admin2 only

 Group: Group1, or Group3

In Microsoft Entra ID (Azure Active Directory), Self-Service Password Reset (SSPR) is configured at the tenant level and can be scoped either to all users or to selected groups. Both who can configure SSPR and which groups are eligible are strictly defined by Microsoft Entra role permissions and group support rules.

Who can configure SSPR

Microsoft Entra documentation clearly states that only the following administrative roles are authorized to configure and manage SSPR settings:

Global Administrator

Authentication Policy Administrator

In this scenario:

Admin1 is a Global Administrator → ✅ Allowed

Admin2 is an Authentication Policy Administrator → ✅ Allowed

Admin3 holds Authentication Administrator and Security Administrator roles → ❌ These roles cannot configure SSPR policies

Microsoft explicitly distinguishes authentication method management from SSPR policy configuration, which is why Authentication Administrators and Security Administrators do not have permission to configure SSPR.

✔ Correct Users selection: Admin1 and Admin2 only

Which groups can have SSPR enabled

When enabling SSPR for Selected users, Microsoft Entra supports only assigned membership security-based groups.

According to Microsoft documentation:

Security groups (Assigned) → ✅ Supported

Mail-enabled security groups (Assigned) → ✅ Supported

Microsoft 365 groups → ❌ Not supported

Dynamic groups → ❌ Not supported

Applying this to the provided groups:

Group1 – Security, Assigned → ✅ Eligible

Group2 – Microsoft 365, Dynamic → ❌ Not eligible

Group3 – Mail-enabled security, Assigned → ✅ Eligible

✔ Correct Group selection: Group1 or Group3 only

Final Answer Summary

Section

Correct Selection

Users

Admin1 and Admin2 only

Group

Group1 or Group3 only

Microsoft Entra Administrator documentation extract:

“Only Global Administrators and Authentication Policy Administrators can configure self-service password reset settings.”

“SSPR can be enabled for security groups and mail-enabled security groups with assigned membership. Dynamic groups and Microsoft 365 groups are not supported.”

✅ Final Verified Answer:

Users: Admin1 and Admin2 only

Group: Group1 or Group3 only

https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization?tabs=azure-portal & pivots=vaults-recovery-services-vault#before-you-start

Before you start

Ensure the Resource Guard and the Recovery Services vault are in the same Azure region.

Ensure the Backup admin does not have Contributor permissions on the Resource Guard. You can choose to have the Resource Guard in another subscription of the same directory or in another directory to ensure maximum isolation.

Ensure that your subscriptions containing the Recovery Services vault as well as the Resource Guard (in different subscriptions or tenants) are registered to use the providers - Microsoft.RecoveryServices and Microsoft.DataProtection . For more information, see Azure

The screenshot shows the Schedule Backup Wizard (Files and Folders), which is the Microsoft Azure Recovery Services (MARS) agent experience. This is file/folder backup to a Recovery Services vault, not an “Azure VM backup” policy-based backup. In Microsoft’s Azure Backup guidance, the MARS agent protects files and folders on a Windows machine by uploading encrypted backup data to the Recovery Services vault. The encryption is controlled by a customer-managed passphrase, and Azure does not store that passphrase.

Because MARS backups are agent-based, restore is not limited to the original VM or to the VM’s region. Microsoft documentation for MARS restore describes restoring to the original location or to an alternate location, including another server, as long as the target machine is registered to the same vault and you provide the same passphrase used to encrypt the backups. The presence of VM2 in West US does not block restore for MARS-protected files/folders; region coupling is a constraint for Azure VM backup (vault and VM must be in the same region), not for MARS agent file/folder backup.

So, after redeploying or on another VM, you install and register the MARS agent to Vault1, then perform a restore of Folder1 using the correct passphrase—VM2 is a valid restore target.

Moving the virtual machine to a different resource group does not change the host that the virtual machine runs on. It only changes the logical grouping of the resources. To move the virtual machine to a different host, you need to redeploy it or use Azure Site Recovery. Then, References: [Move resources to new resource group or subscription] [Redeploy Windows VM to new Azure node] [Use Azure Site Recovery to migrate Azure VMs between Azure regions]

Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines (VMs) in your virtual network (VNet), directly through the Azure portal, without exposing public IP addresses.

???? Scenario Breakdown

From the question:

You have several resources connected to a single VNet1, including:

VM1 – a virtual machine

App1 – likely an Azure App Service or web app

contoso.com – a custom domain or DNS zone

You plan to deploy an Azure Bastion host named Bastion1 into VNet1.

???? What Azure Bastion Protects

According to Microsoft Learn (“What is Azure Bastion?”):

“Azure Bastion provides secure RDP and SSH connectivity to virtual machines in your virtual network directly from the Azure portal, without requiring a public IP address on your virtual machines.”

Key characteristics:

Works only with VMs (Windows or Linux) deployed inside the same virtual network or peered virtual networks.

Enables RDP/SSH sessions through the browser.

Does not apply to App Services, DNS zones, Azure AD, storage accounts, or any PaaS resources.

Does not provide protection for domain names or endpoints such as contoso.com.

???? Analysis of Options

Resource

Description

Can Bastion protect it?

Reason

VM1

Virtual Machine in VNet1

✅ Yes

Bastion provides RDP/SSH access without public IP

App1

Likely an Azure Web App / PaaS

❌ No

Web Apps are accessed via HTTPS, not RDP/SSH

contoso.com

Custom domain / DNS zone

❌ No

Not a networked compute resource

???? Correct Answer

✅ A. VM1 only

Because:

Bastion can only secure VMs through private IP connections for RDP (Windows) and SSH (Linux).

App1 (App Service) and contoso.com (custom domain) are not eligible for Bastion protection.

???? Microsoft Official Documentation Extract (Azure Administrator Study Guide)

“Azure Bastion is a fully managed service that provides secure and seamless RDP and SSH connectivity to your virtual machines directly through the Azure portal over SSL. Bastion hosts are deployed per virtual network and support virtual machines within that network and any peered networks.”

“Azure Bastion cannot be used to connect to PaaS services such as App Service, SQL Database, or any resource that does not have a NIC inside the virtual network.”

✅ Final Verified Answer: A. VM1 only

Azure Bastion provides secure RDP/SSH access to VMs within the same VNet or peered VNets, but it does not apply to App Services or custom domains.

The Advisor dashboard displays personalized recommendations for all your subscriptions. You can apply filters to display recommendations for specific subscriptions and resource types. The recommendations are divided into five categories:

Reliability (formerly called High Availability): To ensure and improve the continuity of your business-critical applications. For more information, see Advisor Reliability recommendations.

Security: To detect threats and vulnerabilities that might lead to security breaches. For more information, see Advisor Security recommendations.

Performance: To improve the speed of your applications. For more information, see Advisor Performance recommendations.

Cost: To optimize and reduce your overall Azure spending. For more information, see Advisor Cost recommendations.

Operational Excellence: To help you achieve process and workflow efficiency, resource manageability and deployment best practices. . For more information, see Advisor Operational Excellence recommendations.