Passing AZ-104 with 875: Azure Administrator Certification Strategy for Enterprise Identity & Governance

Architectural Premise & The Real-World Challenge

Scoring 875 on AZ-104 is not an accident of good luck on scenario questions. It reflects a specific preparation architecture — one built around understanding why Azure constructs exist rather than memorizing portal click-paths that Microsoft rotates between exam refreshes. The exam blueprint is deceptively broad: five domain areas, each demanding operational depth, and a scaled scoring engine that can deliver a 700 pass to someone who genuinely knows 70% of the material or to someone who knows 85% but clusters their knowledge incorrectly.

For enterprise M365 and Intune architects, the motivation for AZ-104 goes beyond a credential badge. Managed identities feeding Graph API authentication, service principal configurations underpinning Conditional Access policy enforcement, VNet private endpoints protecting Intune log sinks in Azure Monitor — these are the exact constructs you interact with in production. Passing at 875 means you're operating above the threshold where you can actually design these integrations, not just implement someone else's ARM template.

The non-obvious challenge: Microsoft's scaling algorithm means a 700 and an 875 can represent materially different knowledge distributions. A candidate who aces Identity and Governance but blanks on VNet peering and NSG rule evaluation order can still pass. But they'll hit walls immediately in production when a Conditional Access Named Location depends on a correctly configured route table and a private DNS resolver they don't understand. The 875 target forces you to close those gaps.

The other architectural trade-off that standard Microsoft Learn paths gloss over: the AZ-104 objective domains are weighted, but the weighting ranges are intentionally fuzzy (e.g., "20–25%"). This ambiguity is deliberate. Microsoft can shift item pools between refreshes without violating their published blueprint. Preparing to the ceiling of each range protects you from refresh volatility and is precisely what separates 875-level scorers from 720-level scrapers.

Under the Hood: Exam Mechanics & The Enterprise Knowledge Engine

Before mapping study strategy to domains, understanding what the exam actually measures changes everything. AZ-104 is delivered through Pearson VUE on a fixed-form adaptive variant — meaning your item set is pre-selected based on your profile, but the difficulty of follow-on questions in case-study labs can shift based on earlier performance within that lab set. This is distinct from a fully adaptive CAT. You'll see 40–60 scored items plus potentially unscored experimental items you cannot identify.

The question archetypes that produce 875-level differentiation are not the "which portal blade" questions. They're the scenario-chain questions where a described enterprise environment has four constraints and asks which combination of two configuration choices satisfies all of them. These require holding the full dependency graph of Azure constructs in working memory simultaneously.

The five objective domains, mapped to their enterprise infrastructure relevance and realistic 875-level study investment ratios:

Domain Dissection: Identity & Governance at Enterprise Depth

Identity and Governance is the highest-leverage domain for M365 architects — and the one most candidates underestimate in technical depth. The Microsoft Learn path covers the surface: creating users, assigning roles, configuring MFA. What gets candidates at the 875 threshold is the mechanics of how these constructs behave at scale in hybrid configurations.

Managed Identities deserve a disproportionate share of your study time. The distinction between System-Assigned and User-Assigned managed identities is table stakes. What the exam actually probes is token acquisition flow: a System-Assigned MI on a VM calling http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/, the Azure Instance Metadata Service (IMDS) endpoint returning a JWT, and what happens when that VM sits behind an NSG that blocks outbound to the internal IMDS IP. That last scenario — IMDS connectivity failure — is a production gotcha that appears in exam scenario chains.

Custom RBAC roles are the other deep-water area. The exam will present a JSON role definition and ask you to identify which action is missing to satisfy a described business requirement, or conversely, which NotAction makes an existing role non-compliant with least privilege. For Intune architects: understanding how to scope a custom role to a specific resource group while allowing read across the subscription is directly applicable to building automation service principals for Intune Graph API integrations.

// Example: Custom RBAC Role — Intune Automation SP (Least Privilege)
// Scope: contoso subscription, restricted to rg-intune-automation resource group
{
  "Name": "Intune Graph Automation Contributor",
  "IsCustom": true,
  "Description": "Allows Intune automation SP to read/write storage and monitor resources",
  "Actions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
    "Microsoft.OperationalInsights/workspaces/read",
    "Microsoft.OperationalInsights/workspaces/query/read",
    "Microsoft.Insights/diagnosticSettings/write"
  ],
  "NotActions": [
    "Microsoft.Storage/storageAccounts/delete",
    "Microsoft.Storage/storageAccounts/listKeys/action"
  ],
  "AssignableScopes": [
    "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-intune-automation"
  ]
}

Entra ID Connect and Hybrid Identity scenarios appear frequently in case study labs. Know the sync cycle phases: delta import, delta sync, export. Know what happens when an on-premises AD object is out of scope of the sync rule filter — the object soft-deletes in Entra ID after 30 days in the recycle bin. Know the difference between Password Hash Sync, Pass-Through Authentication, and Federation, and specifically why an enterprise would layer Seamless SSO on top of PHS rather than running PTA. For Intune architects: this directly maps to understanding why a hybrid Entra Join device can authenticate to Intune MDM enrollment endpoints without a network line of sight to a DC when PHS is the auth method.

Enterprise Edge Cases & Scale Gotchas

Networking is where technically strong candidates lose points they shouldn't. The VNet domain contains the highest density of rules-based evaluation questions — scenarios where you must trace the effective result of overlapping NSG rules, UDRs, and Azure Firewall policy DNAT rules simultaneously.

Effective route calculation is the most-failed sub-objective at 875+ difficulty. Azure evaluates routes in this precedence order: User-Defined Routes → BGP routes → System routes. But there's a production caveat: a UDR with a next-hop of Virtual Network Gateway doesn't override a system route for the same prefix if the system route is more specific. The exam will construct scenarios where a /28 system route beats a /24 UDR — and the expected answer requires you to know that more-specific always wins over next-hop type precedence when prefixes differ.

Private Endpoints and DNS resolution is the other networking landmine. When you create a Private Endpoint for a storage account in VNet A and peer VNet A to VNet B, the Private DNS Zone linked to VNet A does not automatically resolve for hosts in VNet B unless you also link the zone to VNet B. This is a production failure mode for Intune environments where a Log Analytics workspace private link is deployed in a hub VNet but Intune diagnostic export flows originate from a spoke VNet. The exam surfaces this exact topology and expects you to identify the DNS link as the missing configuration, not a new NSG rule or peering configuration.

Production Implementation & Automation: Validating AZ-104 Knowledge via Graph

One of the most effective study methodologies for 875-level preparation is building automation that exercises exam objectives in a real tenant. The following script validates the exact identity governance constructs the exam targets — enumerating custom RBAC role assignments scoped to a resource group, checking managed identity federation configurations, and confirming diagnostic settings on a storage account. This is the kind of production tooling you build as you study, reinforcing the constructs through operational application rather than passive reading.

#Requires -Version 7.2
#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.Governance

<# 
.SYNOPSIS
    AZ-104 Study Lab Validator — Identity & Governance Domain
    Validates custom RBAC roles, managed identity federation, and 
    diagnostic settings for an AZ-104 exam prep lab environment.

.DESCRIPTION
    Exercises core AZ-104 Identity & Governance and Monitor domain objectives
    against a real Azure subscription using Microsoft Graph v2 and Az module.
    Designed for enterprise lab environments (contoso.onmicrosoft.com).

    Required Graph Scopes:
        RoleManagement.Read.Directory
        Directory.Read.All
        Policy.Read.All

    Required Az RBAC:
        Reader on target subscription
        Reader on target resource group

.PARAMETER SubscriptionId
    Target Azure subscription GUID.

.PARAMETER ResourceGroupName
    Resource group to validate RBAC scope assignments against.

.PARAMETER StorageAccountName
    Storage account name to validate diagnostic settings.

.EXAMPLE
    .\Validate-AZ104LabIdentity.ps1 `
        -SubscriptionId "00000000-0000-0000-0000-000000000000" `
        -ResourceGroupName "rg-intune-automation" `
        -StorageAccountName "stcontosodiag01"
#>

[CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')]
param(
    [Parameter(Mandatory)]
    [ValidatePattern('^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$')]
    [string]$SubscriptionId,

    [Parameter(Mandatory)]
    [string]$ResourceGroupName,

    [Parameter(Mandatory)]
    [string]$StorageAccountName
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# ── 1. Connect to Microsoft Graph (required scopes) ──────────────────────────
$requiredScopes = @(
    'RoleManagement.Read.Directory',
    'Directory.Read.All',
    'Policy.Read.All'
)

try {
    Write-Host "[INFO] Connecting to Microsoft Graph..." -ForegroundColor Cyan
    Connect-MgGraph -Scopes $requiredScopes -NoWelcome
    $context = Get-MgContext
    Write-Host "[OK]   Connected as: $($context.Account) | TenantId: $($context.TenantId)" `
        -ForegroundColor Green
}
catch {
    Write-Error "[FATAL] Graph connection failed: $_"
    exit 1
}

# ── 2. Enumerate Custom RBAC Roles scoped to Resource Group ──────────────────
Write-Host "`n[DOMAIN: Identity & Governance] Auditing custom RBAC role assignments..." `
    -ForegroundColor Magenta

$rgScope = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName"

try {
    # Using Invoke-MgGraphRequest for ARM endpoint — Graph doesn't expose ARM RBAC
    $armToken = (Get-MgContext).AccessToken
    $armHeaders = @{ Authorization = "Bearer $armToken"; 'Content-Type' = 'application/json' }

    $assignmentsUri = "https://management.azure.com$($rgScope)/providers/" +
        "Microsoft.Authorization/roleAssignments?api-version=2022-04-01"

    $assignments = Invoke-RestMethod -Method GET -Uri $assignmentsUri `
        -Headers $armHeaders

    $customAssignments = $assignments.value | Where-Object {
        $_.properties.roleDefinitionId -notmatch `
            '/providers/Microsoft.Authorization/roleDefinitions/[a-f0-9-]{36}'
    }

    Write-Host "[OK]   Total assignments on $ResourceGroupName : $($assignments.value.Count)"
    Write-Host "[INFO] Assignments referencing custom role definitions: $($customAssignments.Count)"

    foreach ($a in $assignments.value) {
        $roleDefId = $a.properties.roleDefinitionId.Split('/')[-1]
        $roleDef = Invoke-RestMethod -Method GET `
            -Uri "https://management.azure.com/subscriptions/$SubscriptionId/providers/Microsoft.Authorization/roleDefinitions/$($roleDefId)?api-version=2022-04-01" `
            -Headers $armHeaders
        
        $isCustom = $roleDef.properties.type -eq 'CustomRole'
        $customTag = if ($isCustom) { "[CUSTOM]" } else { "[BUILTIN]" }
        Write-Host "  $customTag $($roleDef.properties.roleName) → $($a.properties.principalId)"
    }
}
catch {
    Write-Warning "[WARN] RBAC enumeration failed: $_"
}

# ── 3. Validate Managed Identity Federation Status ────────────────────────────
Write-Host "`n[DOMAIN: Identity & Governance] Checking User-Assigned Managed Identities..." `
    -ForegroundColor Magenta

try {
    # Query Graph for Service Principals with ServicePrincipalType = ManagedIdentity
    $miFilter = "servicePrincipalType eq 'ManagedIdentity'"
    $managedIdentities = Invoke-MgGraphRequest -Method GET `
        -Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=$miFilter&`$select=id,displayName,servicePrincipalType,appId"

    Write-Host "[OK]   Managed Identity Service Principals found: $($managedIdentities.value.Count)"

    foreach ($mi in $managedIdentities.value) {
        # Check federated identity credentials (AZ-104 objective: OIDC federation)
        $fedCreds = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($mi.id)/federatedIdentityCredentials"

        $fedCount = $fedCreds.value.Count
        $fedStatus = if ($fedCount -gt 0) { "[$fedCount federated credentials]" } else { "[No federation]" }
        Write-Host "  MI: $($mi.displayName) | AppId: $($mi.appId) $fedStatus"
    }
}
catch {
    Write-Warning "[WARN] Managed Identity query failed: $_"
}

# ── 4. Validate Diagnostic Settings on Storage Account ───────────────────────
Write-Host "`n[DOMAIN: Monitor] Validating Diagnostic Settings on Storage Account..." `
    -ForegroundColor Magenta

try {
    $storageResourceId = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName" +
        "/providers/Microsoft.Storage/storageAccounts/$StorageAccountName"

    $diagUri = "https://management.azure.com$($storageResourceId)" +
        "/providers/microsoft.insights/diagnosticSettings?api-version=2021-05-01-preview"

    $diagSettings = Invoke-RestMethod -Method GET -Uri $diagUri -Headers $armHeaders

    if ($diagSettings.value.Count -eq 0) {
        Write-Warning "[WARN] No diagnostic settings configured on $StorageAccountName"
        Write-Warning "       AZ-104 Objective: Configure Azure Monitor diagnostic settings"
    }
    else {
        foreach ($ds in $diagSettings.value) {
            $sink = if ($ds.properties.workspaceId) { "Log Analytics" } `
                    elseif ($ds.properties.storageAccountId) { "Storage" } `
                    elseif ($ds.properties.eventHubAuthorizationRuleId) { "Event Hub" } `
                    else { "Unknown" }
            Write-Host "[OK]   DiagSetting: '$($ds.name)' → Sink: $sink"
        }
    }
}
catch {
    Write-Warning "[WARN] Diagnostic settings check failed: $_"
}

# ── 5. Conditional Access Policy Inventory (Governance cross-check) ──────────
Write-Host "`n[DOMAIN: Identity & Governance] Enumerating Conditional Access Policies..." `
    -ForegroundColor Magenta

if ($PSCmdlet.ShouldProcess("Entra ID Tenant", "Read Conditional Access Policies")) {
    try {
        $caPolicies = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?`$select=displayName,state,conditions,grantControls"

        $enabledCount  = ($caPolicies.value | Where-Object { $_.state -eq 'enabled' }).Count
        $reportOnly    = ($caPolicies.value | Where-Object { $_.state -eq 'enabledForReportingButNotEnforced' }).Count
        $disabledCount = ($caPolicies.value | Where-Object { $_.state -eq 'disabled' }).Count

        Write-Host "[OK]   CA Policies — Enabled: $enabledCount | Report-Only: $reportOnly | Disabled: $disabledCount"
    }
    catch {
        Write-Warning "[WARN] Conditional Access read failed (check Policy.Read.All scope): $_"
    }
}

Write-Host "`n[COMPLETE] AZ-104 Lab Validation finished." -ForegroundColor Green
exit 0

The Five Hardest Exam Objectives & How to Close Them

These aren't the hardest because the concepts are complex in isolation. They're hard because the exam presents them in combination with other constraints, requiring simultaneous evaluation of multiple Azure rule systems.

1. Effective NSG + Azure Firewall + UDR rule evaluation
   Build a lab VNet with an Azure Firewall in a dedicated AzureFirewallSubnet, route all spoke traffic to the firewall via UDR, then add an NSG on the spoke subnet. Trace a specific packet and identify whether the NSG or firewall evaluates first. Answer: NSG on the source subnet evaluates on egress first, then UDR routes to firewall. NSG on destination subnet evaluates after firewall allows. The exam will reverse this path and ask which component blocked the connection.
2. Storage redundancy selection with failover behavior
   GRS vs. GZRS vs. RA-GRS — know the exact RPO (typically <15 minutes for GRS replication lag), that Microsoft-initiated failover takes up to 1 hour, and that customer-initiated failover requires storage account to be in a degraded state. RA-GRS secondary endpoint is https://<accountname>-secondary.blob.core.windows.net — readable at all times, not just during failover. GZRS adds zone redundancy within the primary region on top of geo-replication.
3. VM Scale Set (VMSS) autoscale profile precedence
   When a Fixed profile, Recurrence profile, and metric-based Default profile all have overlapping time windows, the Fixed profile wins. But if you define two Recurrence profiles with overlapping schedules, the one that started most recently wins — not the one with higher instance count. The exam constructs scenarios where the expected instance count differs depending on which profile is active.
4. Azure Policy remediation task identity requirements
   A deployIfNotExists or modify policy effect requires a Managed Identity assigned to the policy assignment with RBAC permissions to perform the remediation action. The exam will describe a policy that evaluated as non-compliant but remediation failed — the root cause is always the MI missing the required role on the target scope, not the policy definition itself.
5. Azure Backup MARS agent vs. Recovery Services Vault agent behavior
   MARS agent backs up files/folders directly from on-premises Windows without requiring an Azure VM. It uses the Microsoft Azure Recovery Services agent, which stores backups in a Recovery Services Vault. The exam distinguishes this from the Azure VM backup extension (installed automatically on Azure VMs during first backup). Know that MARS agent requires network connectivity to Azure Backup service URLs — this becomes a scenario question when a corporate proxy or firewall blocks the backup service endpoints.

Architectural Takeaways & the Intune Practitioner Decision Matrix

AZ-104 certification doesn't exist in a silo for enterprise Intune architects. The credential operationally unlocks three infrastructure decisions that previously required escalation to a separate Azure team:

1. Private Endpoint architecture for Intune diagnostic exports. Configuring Intune Diagnostic Settings to stream to a Log Analytics workspace or Storage Account with a private endpoint requires end-to-end understanding of: Private DNS zone linking, VNet integration on the workspace, and NSG rules on the subnet hosting the private endpoint. An AZ-104-certified Intune architect owns this deployment path without needing an Azure Network team intermediary.

2. Managed Identity assignment for automation service principals. Every Intune PowerShell automation that calls the Graph API using a client secret is a credential management liability. The correct enterprise pattern is a User-Assigned Managed Identity assigned to an Azure Automation Account or Logic App, with a federated identity credential if running in GitHub Actions. This entire pattern is AZ-104 material — managed identities, federated credentials, RBAC assignment at resource group scope.

3. Conditional Access Named Locations backed by IP ranges from Azure Firewall. Named Locations in Conditional Access referencing trusted IP ranges should source those ranges from the egress IPs of an Azure Firewall or NAT Gateway — not from individual device IPs. Maintaining that firewall and understanding its policy hierarchy is AZ-104 Networking domain material.

The 875 score is a precision outcome, not a volume outcome. Candidates who attempt to cover every Microsoft Learn module uniformly cap around 720–750. The 875 path requires identifying the eight to ten highest-weight, highest-difficulty objectives across all five domains, achieving operational fluency in those specific areas through lab-based validation, and accepting that moderate depth on lower-weight objectives is sufficient. Identity and Governance at depth, Networking rule evaluation with precision, and enough Monitor/KQL fluency to answer scenario questions confidently — that's the architecture of the score.