AZ-900 vs AZ-104: Which Azure Cert Should You Take First?
Ask ten people in Azure which certification to take first and you will get two confident answers, each the opposite of the other. One camp says start with AZ-900, always — it is the foundation, and skipping it is skipping the basics. The other says go straight to AZ-104 — AZ-900 is too easy to be worth your time, and the associate exam is the one employers actually ask about.
Both camps are answering the wrong question. AZ-900 and AZ-104 are not two rungs of the same ladder, where one must come before the other. They are two different kinds of exam, built for two different kinds of candidate. The right first exam is not the easier one or the more impressive one. It is the one that matches where you actually are with Azure today.
What does each exam actually test?
AZ-900, Microsoft Azure Fundamentals, is a literacy exam. It asks whether you understand cloud concepts and can talk sensibly about Azure: what the cloud service models mean, how Azure organizes resources, what the core services do, and how governance, security, and cost fit together. It covers cloud concepts, Azure architecture and services, and Azure management and governance — at the level of understanding, not doing.
That last distinction matters. AZ-900 does not ask you to configure anything. It asks you to recognize what a service is for, when it is the right choice, and what it costs to run. A candidate who can explain why a workload belongs in Azure, which service fits it, and how an organization keeps that workload governed and affordable will do well. A candidate who can recite service names but cannot explain the trade-off between them will struggle, because the exam tests judgment at a conceptual level, not vocabulary.
AZ-104, Microsoft Azure Administrator, is an operations exam. It asks whether you can implement, manage, and monitor an Azure environment: the day-to-day work of an administrator. Its five skill areas are managing Azure identities and governance, implementing and managing storage, deploying and managing compute resources, implementing and managing virtual networking, and monitoring and maintaining Azure resources.
Notice how different those verbs are. AZ-900 asks you to describe. AZ-104 asks you to manage, implement, deploy, and monitor. An AZ-104 question does not ask what a virtual network is. It asks what happens when a network security group rule, a route, and a private endpoint disagree about whether traffic should reach a resource — and which of those controls you should change first. That is not a harder version of the same question. It is a different job.
Is AZ-900 a prerequisite for AZ-104?
No — and this is the misconception that causes most of the bad advice. Microsoft does not require AZ-900 before AZ-104. You can book AZ-104 directly, and many working administrators do exactly that.
That does not mean AZ-900 is useless for someone heading to AZ-104. It means the two exams are not chained together, so the decision is free — and should be made on your background, not on a rule that does not exist.
Think of it this way: AZ-900 teaches you the language of Azure. AZ-104 teaches you the work of Azure. If you already speak the language — because you administer Azure, or you have spent time in a neighboring cloud, or you work with Azure infrastructure every day — you do not need a language course before starting the work. If you do not yet speak the language, starting with the work means learning the vocabulary and the job at the same time, under exam pressure. That is possible, but it is a harder road than most people admit.
Which exam fits your starting point?
The cleanest way to decide is to match yourself to one of four starting points, honestly.
You are new to cloud, or to IT. You have no Azure experience, or you are coming from a non-technical role — sales, support, business analysis, management — and you need to understand Azure before you can work with it. Take AZ-900 first. It gives you the vocabulary, the service landscape, and the governance and cost concepts in a structured form, and it gives you a credential at the end of a short, achievable study period. From there, AZ-104 is a natural next step, and it will be easier because you will not be learning what a resource group is at the same time as learning how to govern one.
You work in IT support or on a helpdesk and want into cloud administration. This is the borderline case, and the honest answer depends on your hands-on exposure. If you have touched Azure in your job — even at the level of resetting accounts, looking at a portal, or supporting users on Azure-hosted applications — AZ-900 will feel familiar, and you may be able to move through it quickly. If Azure is still mostly theoretical to you, take AZ-900 first and treat it as the foundation for AZ-104, not as a detour. The time you spend there is not wasted: every AZ-104 domain assumes the concepts AZ-900 teaches.
You already administer systems — on-premises or in another cloud. You manage servers, networks, or identities today, and Azure is the new platform, not a new profession. You can reasonably start with AZ-104. Your existing administration judgment transfers: you already know what identity, storage, compute, and networking mean, and what goes wrong with each. What you need to learn is how Azure expresses those things — Entra ID and role-based access control, storage accounts and redundancy, virtual networks and network security groups — and that is exactly what AZ-104 teaches. Skipping AZ-900 here is not cutting a corner. It is recognizing that you already hold the foundation it provides.
You already administer Azure, even informally. You are the person your team asks when something in Azure breaks, or you manage a subscription, a set of virtual machines, or a storage estate as part of your current role. Take AZ-104, and take it soon. AZ-900 would confirm things you already know. AZ-104 tests the work you already do, and formalizes it into the associate credential that matches the role.
If you are still unsure after reading those four, there is a simple tiebreaker: open a free Azure account and try to do three small jobs — create a resource group, deploy a virtual machine, and restrict access to a storage account to one network. If those jobs feel like learning a new language, start with AZ-900. If they feel like learning a new dialect of a language you already speak, start with AZ-104.
What does AZ-104 demand that AZ-900 does not?
The gap between the two exams is not just difficulty. It is the kind of knowledge they reward.
AZ-900 rewards understanding. You need to know what services exist, what they are for, and how they relate. A question might describe a business need — a company wants to run a website that scales with demand — and ask which service fits. The right answer comes from understanding the service's purpose.
AZ-104 rewards decision-making under constraint. Its questions describe a working environment with several moving parts, and ask you to choose the configuration that satisfies all of them at once. A question might describe a virtual machine that cannot reach a storage account, and offer four plausible fixes — a firewall rule, a private endpoint, a role assignment, a network route. Only one of them addresses the actual cause, and the others fix a different problem than the one described. Getting it right means tracing the failure through the stack, not recognizing a service name.
That is why AZ-104 study feels different. Reading about Azure is not enough for it. You need to have built things, broken things, and fixed things in a real subscription — or at least in a practice environment that behaves like one. The exam's five domains give you the study map: identities and governance and compute carry the largest weightings in Microsoft's study guide, with storage and networking close behind and monitoring the smallest share. Those weightings are ranges, not a promise of how many questions each area will contribute on any given form, but they tell you where to put your time: identity and access decisions, and compute deployment and scaling, deserve the largest share of it.
The other demand AZ-104 makes is precision about scope. In Azure, almost every permission, policy, and network rule applies at a scope — a management group, a subscription, a resource group, a single resource — and the same rule behaves differently at different scopes. AZ-900 teaches you that scopes exist. AZ-104 tests whether you can reason about them: a role assignment at the resource-group level does not reach a resource in another group, a policy at the subscription level reaches everything below it, and a network rule that looks correct at one level can be overridden by a rule at another. Candidates who study AZ-104 as a list of services, rather than as a system of scopes, keep choosing answers that would be right in a simpler environment than the one described.
How should you study for each path?
The two paths need different study weeks, because they train different skills.
The AZ-900 study week is a reading and reasoning week. Work through the Microsoft Learn fundamentals path, and for each service ask three questions: what problem does this solve, what would you use instead, and what does it cost to run? Then test yourself with scenario questions, not flashcards. Flashcards teach you that a virtual network exists. Scenario questions teach you that a virtual network is the answer when isolation and private connectivity are the requirements, and the wrong answer when the requirement is simply hosting a public website. Finish the week with a timed practice test, and use the result the way the exam will: not as a score to chase, but as a map of which concepts are still fuzzy.
The AZ-104 study week is a doing week. For each of the five domains, build the thing in a practice subscription, then break it deliberately. Create users and groups in Entra ID, assign roles at different scopes, and check what each identity can actually do — not what you think it can do. Create a storage account, turn on its firewall, and watch access fail until you add the right exception. Deploy a virtual machine, put it behind a network security group, and trace why a connection is refused. Then do the same work under time pressure, because the exam will not give you a portal to click through: it will give you a described environment and ask you to reason about it without one. Timed practice questions are where that reasoning gets trained, and where you discover whether you actually understand scopes or merely recognize the word.
In both cases, the same rule applies that applies to every certification exam: practice tests are for finding gaps, not for memorizing answers. A practice question you get wrong is worth more than ten you get right, because it shows you exactly where your mental model diverges from the exam's. Read the explanation, rebuild the scenario, and retest yourself on the same concept from a different angle before moving on.
So, which one first?
If Azure is still mostly theoretical to you, take AZ-900 first. It is the shorter, more achievable exam, it gives you the language and the landscape, and it makes AZ-104 measurably easier when you get there. Taking it is not a sign of weakness. It is a sign that you are building in the right order.
If you already administer systems, or you already work in Azure, take AZ-104 first. You do not need a fundamentals exam to prove you understand concepts you use every day, and the associate credential matches the work you are already doing. Skipping AZ-900 here is not a shortcut. It is the honest assessment that the foundation is already in place.
And if you take AZ-900 and then AZ-104 — the path most beginners end up on — that is not a slow path. It is the normal path. The fundamentals exam exists precisely so that the associate exam does not have to teach you the language at the same time as the job. Use it that way, and both exams get easier.
Whichever you choose, start with the exam that matches your starting point, not the one that sounds most impressive. The credential that helps your career is the one you can actually pass, and pass for the right reasons — because you understand the material, not because you guessed your way through a harder exam you were not ready for.
Try a free practice test for the exam you are leaning toward — no signup, instant feedback — and let the result settle the question for you: the AZ-900 practice test at https://study4pass.com/study-material/microsoft/az-900, or the AZ-104 practice test at https://study4pass.com/study-material/microsoft/az-104. If the fundamentals questions feel easy and the administrator questions feel like a different job, your path is AZ-900, then AZ-104. If the administrator questions feel like work you already do, your path starts at AZ-104.