Conquering AZ-104: A Senior Endpoint Architect's Blueprint for Azure Administrator Success & Avoiding Common Pitfalls

Architectural Premise & The Real-World Challenge

Most senior endpoint engineers who sit for the AZ-104 (Azure Administrator Associate) exam fail on their first attempt not because they lack technical depth, but because endpoint architecture breeds a dangerous cognitive bias: conflating the Entra ID tenant plane with the Azure Resource Manager (ARM) control plane. In the Microsoft Intune and Windows client ecosystem, an identity with Global Administrator or Intune Administrator rules supreme across Graph API, Settings Catalog CSPs, and tenant-wide device configurations. Cross the threshold into Azure IaaS and PaaS, and that same identity cannot even read the contents of an Azure Storage blob container or inspect a Virtual Network subnet without explicit Azure role-based access control (Azure RBAC) data-plane permissions.

In enterprise engineering, this boundary is where production incidents occur. AZ-104 is not an exam about clicking through the Azure Portal; it tests your comprehension of resource hierarchies, programmatic access delegation, identity federation, transit routing, and lifecycle state management under strict SLA constraints. For an Endpoint Architect, mastering AZ-104 is the prerequisite for designing enterprise-scale Cloud PC (Windows 365) fabrics, Azure Virtual Desktop (AVD) session host pools, resilient Intune Win32 content distribution topologies, and secure hybrid device onboarding. When you design a custom Azure Files share backed by Microsoft Entra Kerberos for 25,000 FSLogix profile containers, an architectural blind spot regarding storage access tiers, Kerberos ticket realms, or Network Security Group (NSG) stateful inspection will bring down your entire modern workplace infrastructure.

Under the Hood: Execution Engine & Mechanics

To pass AZ-104 and implement enterprise cloud infrastructure that interfaces with Intune-managed fleets, you must understand how ARM evaluates transactions down to the REST API request pipeline. Every deployment—whether originated by Bicep, Terraform, the Azure CLI, or the Microsoft Graph PowerShell SDK—submits an authenticated HTTP verb against https://management.azure.com. The ARM dispatcher evaluates four gates in sequence: authentication token validation against Entra ID, authorization check against the Azure RBAC provider (Microsoft.Authorization), policy evaluation via the Azure Policy engine, and subscription quota/resource lock enforcement.

Consider the architecture below. It illustrates the dual-engine reality of modern endpoint environments: the Intune/Graph control plane managing the operating system layer, intersecting with the Azure ARM control plane managing the hosting fabric, network routing, storage authentication, and telemetry ingestion via Azure Monitor Data Collection Rules (DCRs).

The core execution path relies on distinguishing between the Management Plane and the Data Plane. AZ-104 questions deliberately set traps around these mechanics:

• Management Plane: Targeted at management.azure.com. Actions follow the format Microsoft.Compute/virtualMachines/*/read or write. Governed by Azure RBAC roles such as Contributor, Reader, or Virtual Machine Contributor. This allows you to restart an AVD host, attach a NIC, or resize a VM SKU, but does not grant rights to log into the Windows OS via RDP or decrypt the storage volume.
• Data Plane: Targeted directly at resource service endpoints (e.g., https://<storageaccount>.blob.core.windows.net or Azure Key Vault secrets). Actions follow the format Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. Contributor permissions at the resource group level grant zero read rights to blob data unless paired with Storage Blob Data Reader/Contributor or fallback access keys.

Enterprise Edge Cases & Scale Gotchas

When you transition from operating a pure SaaS Intune tenant to deploying supporting infrastructure in Azure, specific AZ-104 domain mechanics introduce silent enterprise production failures if not understood at the protocol level.

1. Azure Files SMB Authentication via Entra Kerberos

Deploying FSLogix for Azure Virtual Desktop or large-scale package caching requires Azure Files shares configured for SMB. The modern standard relies on Microsoft Entra Kerberos rather than legacy Active Directory Domain Services (AD DS) sync. A recurring production gotcha involves Kerberos encryption types and storage account key rotation. If the Azure Storage account object in Entra ID lacks AES-256 encryption enforcement, Windows 11 clients running modern credential guard configurations will reject the Kerberos Ticket Granting Service (TGS) request, falling back to NTLM and failing silently with STATUS_ACCESS_DENIED (0xC0000022).

2. Virtual Network Subnet Sizing & Platform Reserved Addresses

In standard on-premises networking, an administrator subnetting a /24 expects 254 usable host addresses. In Azure, five IP addresses are permanently reserved per subnet (First four: Network ID, Default Gateway, and two Azure DNS resolvers; Last one: Broadcast address). In Cloud PC (Windows 365 Enterprise) provisioning utilizing Azure Network Connections (ANC) or high-density AVD pooled environments, sizing a subnet with an exact host count causes VM provisioning timeouts with obscure error codes like AllocationFailed or SubnetIsFull.

3. NSG Stateful Inspection vs. Asymmetric Routing via NVAs

AZ-104 places heavy emphasis on Network Security Groups (NSGs) and User-Defined Routes (UDRs). While NSGs are stateful (inbound allowed traffic automatically permits return outbound traffic regardless of outbound rules), introducing a Network Virtual Appliance (NVA) via a 0.0.0.0/0 route creates asymmetric routing paths. When Windows clients attempt to reach hybrid endpoints across peered VNets, SYN packets traveling through the firewall while ACK packets bypass it via default VNet peering routing will cause the firewall to drop connections instantly via TCP state validation failures.

Production Implementation & Automation

Enterprise administrators cannot rely on manual point-and-click configurations. The following production-grade PowerShell automation script demonstrates how to programmatically establish the Azure baseline required for an endpoint-supporting infrastructure: an isolated Log Analytics Workspace configured with strict retention caps, Diagnostic Settings streaming Microsoft Entra ID audit/sign-in logs, and a hardened Azure Storage Account configured for Entra RBAC data access with shared access keys explicitly disabled.

This script enforces least-privilege Graph scopes, executes via the Az module using ARM direct endpoints, incorporates [CmdletBinding(SupportsShouldProcess)], and adheres to strict production error handling.

# Required Azure RBAC Roles: Monitoring Contributor, User Access Administrator, Storage Account Contributor
# Execution Context: Azure PowerShell runtime authenticated via Connect-AzAccount

[CmdletBinding(SupportsShouldProcess = $true)]
param (
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string]$ResourceGroupName,

    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string]$Location,

    [Parameter(Mandatory = $true)]
    [ValidatePattern('^[a-z0-9]{3,24}$')]
    [string]$StorageAccountName,

    [Parameter(Mandatory = $false)]
    [string]$WorkspaceName = "law-endpoint-telemetry-prod",

    [Parameter(Mandatory = $false)]
    [int]$LogRetentionDays = 90
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

try {
    # 1. Verify Resource Group Deployment Target
    Write-Verbose "Validating Resource Group: $($ResourceGroupName)"
    $rg = Get-AzResourceGroup -Name $ResourceGroupName -ErrorAction SilentlyContinue

    if (-not $rg) {
        if ($PSCmdlet.ShouldProcess($ResourceGroupName, "Create Resource Group in $($Location)")) {
            $rg = New-AzResourceGroup -Name $ResourceGroupName -Location $Location
            Write-Host "[+] Created Resource Group: $($ResourceGroupName)" -ForegroundColor Green
        }
    } else {
        Write-Host "[*] Utilizing Existing Resource Group: $($ResourceGroupName)" -ForegroundColor Cyan
    }

    # 2. Deploy Azure Monitor Log Analytics Workspace for Endpoint Telemetry
    Write-Verbose "Configuring Log Analytics Workspace: $($WorkspaceName)"
    $law = Get-AzOperationalInsightsWorkspace -ResourceGroupName $ResourceGroupName -Name $WorkspaceName -ErrorAction SilentlyContinue

    if (-not $law) {
        if ($PSCmdlet.ShouldProcess($WorkspaceName, "Provision Operational Insights Workspace")) {
            $law = New-AzOperationalInsightsWorkspace `
                -ResourceGroupName $ResourceGroupName `
                -Name $WorkspaceName `
                -Location $Location `
                -Sku "PerGB2018" `
                -RetentionInDays $LogRetentionDays
            
            Write-Host "[+] Successfully deployed Log Analytics Workspace: $($WorkspaceName)" -ForegroundColor Green
        }
    } else {
        Write-Host "[*] Log Analytics Workspace already provisioned." -ForegroundColor Cyan
    }

    # 3. Deploy Hardened Storage Account (Disabling Shared Key Access - Enforcing Azure RBAC / Entra Only)
    Write-Verbose "Provisioning Zero-Trust Hardened Storage Account: $($StorageAccountName)"
    $storageParams = @{
        ResourceGroupName      = $ResourceGroupName
        Name                   = $StorageAccountName
        Location               = $Location
        SkuName                = "Standard_ZRS"
        Kind                   = "StorageV2"
        EnableHttpsTrafficOnly = $true
        MinimumTlsVersion      = "TLS1_2"
        AllowBlobPublicAccess  = $false
        AllowSharedKeyAccess   = $false # Critical AZ-104 Zero-Trust principle: disable SAS/Account Keys
    }

    if ($PSCmdlet.ShouldProcess($StorageAccountName, "Create Zero-Trust Enforced Storage Account")) {
        $storageAccount = New-AzStorageAccount @storageParams
        Write-Host "[+] Storage account provisioned with Shared Key Access DISABLED." -ForegroundColor Green
    }

    # 4. Stream Storage Account Diagnostic Metrics directly into Log Analytics
    if ($storageAccount -and $law) {
        $diagParams = @{
            ResourceId         = $storageAccount.Id
            WorkspaceId        = $law.ResourceId
            Name               = "diag-storage-to-law"
            Enabled            = $true
        }

        if ($PSCmdlet.ShouldProcess($storageAccount.StorageAccountName, "Attach Diagnostic Pipeline to LAW")) {
            New-AzDiagnosticSetting @diagParams | Out-Null
            Write-Host "[+] Storage diagnostic streaming bound to Log Analytics: $($WorkspaceName)" -ForegroundColor Green
        }
    }

    exit 0
}
catch {
    Write-Error "CRITICAL EXECUTION FAILURE: $($_.Exception.Message)"
    exit 1
}

Step-by-Step AZ-104 Exam & Architecture Blueprint

To systematically internalize and execute the AZ-104 technical domains as an Endpoint Architect, follow this operational blueprint:

1. Isolate Identity Governance from Resource Delegation: Never assign Entra ID roles (User Admin, Cloud Device Admin) when the requirement is granting administrative rights over an Azure compute workload. Map groups exclusively to Azure RBAC built-in roles at the Resource Group or Subscription boundary using the principle of least privilege.
2. Master Subnet CIDR Arithmetic & Azure Default Route Tables: Memorize the 5-address Azure platform reservation. Understand that every subnet inherently contains a system route for 10.0.0.0/8 (or the parent VNet address space) and a default outbound route to the internet. If an exam scenario introduces a firewall, remember that applying a UDR with next-hop Virtual Appliance overrides the default system route, but does not route traffic between subnets in the same VNet unless specified.
3. Decouple Storage Access Methods (IAM vs. Shared Key): Azure Storage authentication questions hinge on how the request is authorized. If access keys are disabled via allowSharedKeyAccess = false, all access via SAS tokens signed with account keys fails immediately. User authentication must flow via Entra ID tokens through role assignments like Storage Blob Data Reader or User Delegation SAS tokens signed by Entra credentials.
4. Understand Backup, Redundancy, and Recovery RTO/RPO Metrics: Differentiate between LRS (3 copies in 1 data center), ZRS (3 copies across 3 availability zones in one region), and GRS (cross-region replication to a paired region). Know that Azure Backup for IaaS VMs creates a snapshot instantly for local operational recovery, followed by out-of-band data transfer to the Recovery Services Vault.
5. Configure Telemetry Ingestion via Data Collection Rules: The legacy Log Analytics Agent (MMA) is completely obsolete. The Azure Monitor Agent (AMA) paired with Data Collection Rules (DCRs) is the mandatory exam and production standard. DCRs allow granular filtering (XPath queries) at the OS level so you only ingest specific Event IDs (e.g., Event ID 4624 for successful logons) rather than whole event streams.

Architectural Takeaways & Decision Matrix

When engineering supporting services for client devices, choose your implementation tier according to the architectural operational requirements summarized below: