AZ-104 Hands-On Lab Guide
Lab Structure Overview
Each lab builds on the previous one. Complete them in order to maximize learning. Each lab includes
cleanup steps to manage your free credits.
Lab 1: Azure Fundamentals (30-45 minutes)
Objective: Get comfortable with Azure portal and basic resource management
Prerequisites
Azure free account activated
Access to Azure portal
Tasks
Task 1.1: Create Resource Groups
1. Sign into Azure portal (portal.azure.com)
2. Click "Resource groups" from the home page
3. Click "+ Create"
4. Create the following resource groups:
Name: rg-lab-eastus
Region: East US
Click "Review + Create" → "Create"
5. Create a second resource group:
Name: rg-lab-westus
Region: West US 2
Task 1.2: Explore Cost Management
1. Go to "Cost Management + Billing"
2. Click "Cost analysis"
3. Review your current spending (should be $0 or minimal)
4. Set up a budget:
Click "Budgets" → "+ Add"
Name: Free-Account-Budget
Amount: $150 (leaving buffer from $200 credit)
Alert at 80% and 90%
Task 1.3: Practice Tagging
1. Go back to your rg-lab-eastus resource group
2. Click "Tags"
3. Add these tags:
Environment: Lab
Project: AZ104-Prep
Owner: [Your Name]
4. Apply and save
Cleanup: Leave resource groups for next lab
Lab 2: Virtual Machines and Storage (45-60 minutes)
Objective: Deploy and manage VMs with storage
Tasks
Task 2.1: Create Storage Account
1. In rg-lab-eastus , click "+ Create"
2. Search for "Storage account" and select it
3. Configure:
Storage account name: stlab[yourname][random numbers] (must be globally unique)
Region: East US
Performance: Standard
Redundancy: LRS (cheapest option)
4. Create the storage account
Task 2.2: Deploy Windows VM
1. In rg-lab-eastus , create a new resource
2. Search for "Virtual machine"
3. Configure:
VM name: vm-web-01
Region: East US
Image: Windows Server 2022 Datacenter
Size: B1s (1 vcpu, 1 GB RAM) - cheapest option
Username: azureuser
Password: Create a strong password (save it!)
Public inbound ports: Allow RDP (3389)
4. Go to "Disks" tab:
OS disk type: Standard HDD (cheapest)
5. Go to "Networking" tab:
Leave default VNet settings (will create new)
6. Review and create
Task 2.3: Deploy Linux VM
1. Create another VM in rg-lab-eastus :
VM name: vm-linux-01
Image: Ubuntu Server 20.04 LTS
Size: B1s
Authentication: SSH public key
Generate new key pair: vm-linux-01_key
Download the private key when prompted
Public inbound ports: Allow SSH (22)
Task 2.4: Connect to VMs
1. Windows VM:
Get public IP from VM overview page
Use Remote Desktop Connection
Connect with azureuser and your password
2. Linux VM:
Get public IP from VM overview page
Use SSH client: ssh -i vm-linux-01_key.pem azureuser@[PUBLIC-IP]
Task 2.5: Storage Operations
1. Go to your storage account
2. Click "Storage browser" → "Blob containers"
3. Create a container named "lab-files"
4. Upload a small test file
5. Try accessing the file URL (should be blocked - private by default)
Cleanup:
Stop both VMs (don't delete yet, we'll use in next lab)
This saves compute costs while preserving the VMs
Lab 3: Networking and Security (60-75 minutes)
Objective: Configure virtual networks, NSGs, and security
Tasks
Task 3.1: Examine Current Network Setup
1. Go to "Virtual networks"
2. Find the VNet created automatically with your VMs
3. Explore:
Address space
Subnets
Connected devices
Task 3.2: Create Custom Virtual Network
1. In rg-lab-westus , create a new Virtual Network:
Name: vnet-lab-custom
Region: West US 2
IPv4 address space: 10.1.0.0/16
Create subnet:
Name: subnet-web
Address range: 10.1.1.0/24
Task 3.3: Network Security Groups
1. Create a Network Security Group in rg-lab-eastus :
Name: nsg-web-servers
Region: East US
2. Add inbound security rules:
Rule 1: Allow HTTP (port 80) from Internet
Rule 2: Allow HTTPS (port 443) from Internet
Rule 3: Allow RDP from your public IP only
3. Associate NSG with your Windows VM:
Go to your Windows VM
Click "Networking" → "Network Interface"
Associate the NSG
Task 3.4: Test Network Security
1. Start your Windows VM
2. RDP into it
3. Try to ping google.com (should work)
4. Install IIS:
Open PowerShell as Administrator
Run: Install-WindowsFeature -name Web-Server -IncludeManagementTools
5. Test HTTP access from browser using VM's public IP
Task 3.5: Create Application Security Groups
1. Create Application Security Group:
Name: asg-web-servers
Resource group: rg-lab-eastus
2. Associate your Windows VM's network interface with this ASG
3. Modify NSG rule to use ASG instead of "Any" destination
Cleanup: Stop VMs to save costs
Lab 4: Identity and Access Management (45-60 minutes)
Objective: Configure Azure AD users, groups, and RBAC
Tasks
Task 4.1: Create Azure AD Users
1. Go to "Azure Active Directory"
2. Click "Users" → "New user"
3. Create user:
Name: John Developer
User name: john@[yourtenant].onmicrosoft.com
Auto-generate password (copy it)
Usage location: Your country
4. Create another user:
Name: Sarah Admin
User name: sarah@[yourtenant].onmicrosoft.com
Task 4.2: Create Groups
1. In Azure AD, click "Groups" → "New group"
2. Create group:
Group type: Security
Group name: Developers
Members: Add John Developer
3. Create another group:
Group name: Admins
Members: Add Sarah Admin
Task 4.3: Assign RBAC Roles
1. Go to rg-lab-eastus
2. Click "Access control (IAM)"
3. Add role assignment:
Role: Virtual Machine Contributor
Assign access to: User, group, or service principal
Select: Developers group
4. Add another role assignment:
Role: Contributor
Select: Admins group
Task 4.4: Test Access
1. Open incognito/private browser window
2. Sign in as John Developer
3. Try to access the resource group
4. Verify John can manage VMs but not create new resource groups
5. Sign out and test with Sarah Admin
Cleanup: Leave users and groups for next lab
Lab 5: Monitoring and Backup (45-60 minutes)
Objective: Set up monitoring, alerts, and backup solutions
Tasks
Task 5.1: Enable VM Insights
1. Start your Windows VM
2. Go to VM → "Insights"
3. Click "Enable"
4. Create new Log Analytics workspace:
Name: law-lab-monitoring
Resource group: rg-lab-eastus
5. Wait for deployment (5-10 minutes)
Task 5.2: Create Alert Rules
1. Go to "Monitor" in Azure portal
2. Click "Alerts" → "Create" → "Alert rule"
3. Configure alert:
Resource: Your Windows VM
Condition: CPU percentage > 80%
Action: Create action group to email you
Alert rule name: High CPU Alert
Task 5.3: Recovery Services Vault
1. In rg-lab-eastus , create "Recovery Services vault":
Name: rsv-lab-backup
Region: East US
2. Configure backup:
Go to vault → "Backup"
Workload: Azure VM
Select your Windows VM
Backup policy: DefaultPolicy (daily backup)
Enable backup
Task 5.4: Test Backup
1. Trigger immediate backup:
Go to VM → "Backup"
Click "Backup now"
Retention: 30 days
2. Monitor backup job progress
Task 5.5: Activity Logs
1. Go to "Activity log"
2. Filter by your resource group
3. Review recent activities
4. Create activity log alert for resource group deletions
Cleanup: Leave monitoring setup for final lab
Lab 6: Automation and Templates (60-75 minutes)
Objective: Use ARM templates and automation
Tasks
Task 6.1: Export ARM Template
1. Go to rg-lab-eastus
2. Click "Export template"
3. Download the template
4. Examine the JSON structure
Task 6.2: Create Simple ARM Template
1. Create a new storage account using template:
json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"storageAccountName": {
"type": "string",
"minLength": 3,
"maxLength": 24
}
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2021-06-01",
"name": "[parameters('storageAccountName')]",
"location": "[resourceGroup().location]",
"sku": {
"name": "Standard_LRS"
},
"kind": "StorageV2"
}
]
}
Task 6.3: Deploy Template
1. Go to "Custom deployment"
2. Build your own template in the editor
3. Paste the template above
4. Deploy to rg-lab-eastus
5. Provide storage account name: sttemplate[random]
Task 6.4: PowerShell/CLI Practice
1. Open Cloud Shell in Azure portal
2. List all resource groups:
bash
az group list --output table
3. Create a resource group via CLI:
bash
az group create --name rg-lab-cli --location eastus
4. List VMs in resource group:
bash
az vm list --resource-group rg-lab-eastus --output table
Cleanup: Keep for final review
Final Cleanup and Review (30 minutes)
Complete Cleanup
1. Delete all resource groups:
rg-lab-eastus
rg-lab-westus
rg-lab-cli
2. Remove custom users from Azure AD (optional)
3. Check cost analysis to see total spend
Review Checklist
Go through each AZ-104 objective and verify you've practiced:
✅ Manage Azure subscriptions and governance
✅ Implement and manage storage
✅ Deploy and manage Azure compute resources
✅ Configure and manage virtual networking
✅ Monitor and back up Azure resources
Next Steps
1. Take practice exams
2. Review areas where you felt less confident
3. Schedule your AZ-104 exam
4. Consider building a more complex multi-tier application for additional practice
Tips for Success
Take notes during each lab about what you learned
Break things intentionally to understand error messages
Time yourself - exam questions often have time pressure
Use the documentation - practice finding answers quickly
Screenshot key configurations for your study notes
Cost Management
Your total spend should be under $20-30 for all labs
Always stop VMs when not in use
Delete resources after each lab unless needed for the next one
Monitor your spending daily in the first week