ESEN

← Fine print by exam

Microsoft Azure · Associate

AZ-104 · Microsoft Azure Administrator

Microsoft Certified: Azure Administrator Associate

Current↗ Official guide🃏 Practice these gotchas

Secretless CI/CD deployments (OIDC federation)

IAM● verified 34 days ago◌ no external reviewer

With Contributor the pipeline can't create role assignments

Contributor does not allow assigning roles in Azure RBAC (it excludes Microsoft.Authorization/*/Write). If your Terraform assigns roles (say, an app's identity on a Key Vault), Contributor is not enough. The quick fix is giving the pipeline Owner or User Access Administrator, which is exactly what you don't want. The right fix is Role Based Access Control Administrator with a condition limiting which roles it can assign (and excluding privileged ones).

Helps with:AZ-104SC-500AZ-400
⚑ Report outdated

See it in the pattern →

Hybrid private DNS (on-premises ↔ cloud)

Reliability● verified 34 days ago◌ no external reviewer

A wildcard "." rule must resolve public names, and 168.63.129.16 can't be a target

If you forward everything with ".", the target DNS must resolve public names: several Azure services depend on it. Some reserved Azure domains are ignored by the wildcard rule anyway. Also, 168.63.129.16 isn't accepted as a rule target, and Microsoft advises against the wildcard in a VNet with an ExpressRoute gateway because it can break management connectivity.

Helps with:AZ-700AZ-104
⚑ Report outdated

See it in the pattern →

Private object ingestion with expiration (TTL)

Reliability● verified 34 days ago◌ no external reviewer

The policy takes up to 24 h to apply and runs in the background

A new or edited lifecycle policy can take up to 24 h to take effect, and each run can take more than a day on large accounts. Don't use lifecycle as a security control ("the file is gone at 48 h"): if the requirement is strict, delete from the application or run your own job.

Helps with:AZ-104
⚑ Report outdated

See it in the pattern →

Cost● verified 34 days ago◌ no external reviewer

With soft delete on, "delete" does not free capacity

If blob soft delete is on, the lifecycle delete action leaves the blob soft-deleted for the retention period, and you keep paying for it. Your effective cost TTL is ttl_days + soft-delete days. The module exposes it as a variable so it's an explicit decision.

Helps with:AZ-104
⚑ Report outdated

See it in the pattern →

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

Disabling Shared Key forces Terraform to use Entra ID

With shared_access_key_enabled = false, every data-plane call must authenticate with Entra ID, including the provider's own. Set storage_use_azuread = true on the azurerm provider and grant the pipeline identity a data role (Contributor is control plane only and is not enough).

Helps with:AZ-104SC-500
⚑ Report outdated

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

Role assignments are per account or container; by prefix you need ABAC conditions

Azure Storage supports role assignments for both storage accounts and blob containers. To scope by prefix or path you need ABAC conditions on the role assignment (Blob prefix and Blob path attributes). Simple alternative: a container dedicated to ingestion (what this module does).

Helps with:AZ-104SC-500
⚑ Report outdated

See it in the pattern →

Networking● verified 34 days ago◌ no external reviewer

Private Endpoint without a private DNS zone: the service firewall can answer 403

Creating the Private Endpoint is not enough: the FQDN <account>.blob.core.windows.net must resolve to the private IP via the privatelink.blob.core.windows.net zone linked to the VNet (or your hybrid DNS). If it resolves to the public IP and the account has a firewall, it rejects the request with 403 and looks like a permissions issue.

Helps with:AZ-700AZ-104
⚑ Report outdated

See it in the pattern →

Zero Trust private web API with passwordless PostgreSQL

Networking● verified 34 days ago◌ no external reviewer

The ACA subnet can't be resized and its minimum size depends on the environment type

A workload profiles environment (the default) needs a dedicated subnet of at least /27 delegated to Microsoft.App/environments; a Consumption-only (legacy) one needs /23 and must NOT be delegated. The size can't be changed after the environment is created, and single-revision deployments temporarily double IP usage. Size for peak replicas, not day one.

Helps with:AZ-104AZ-700
⚑ Report outdated

See it in the pattern →

Cost● verified 34 days ago◌ no external reviewer

Stopping the database stops compute billing, but it restarts on its own after 7 days

PostgreSQL Flexible bills compute while it's on. Stopping it stops compute billing (not storage), but the service automatically restarts it after 7 days. For dev environments, automate the stop instead of relying on a manual one.

Helps with:AZ-104
⚑ Report outdated

See it in the pattern →