Free Microsoft AZ-104 Practice Questions & Answers 2026 Part3 | Microsoft Azure Administrator

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users.Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user. Does this meet the goal?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Azure Active Directory (Azure AD) subscription.You want to implement an Azure AD conditional access policy.The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.Solution: You access the multi-factor authentication page to alter the user settings.Does the solution meet the goal?

Your on-premises network contains a VPN gateway.You have an Azure subscription that contains the resources shown in the following table.You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

You have an Azure subscription that contains a virtual network named VNet1. VNet 1 has two subnets named Subnet1 and Subnet2. VNet1 is in the West Europe Azure region.The subscription contains the virtual machines in the following table.You need to deploy an application gateway named AppGW1 to VNet1.What should you do first?

Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1.The company has users that work remotely. The remote workers require access to the VMs on VNet1. You need to provide access for the remote workers.What should you do?

You need to move the blueprint files to Azure.What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.Does this meet the goal?

You have two Azure subscriptions named Sub1 and Sub2 that are linked to the same Microsoft Entra tenant.An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1.You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must minimize administrative effort.What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that contains the following users in a Microsoft Entra tenant named contoso.onmicrosoft.com:User1 creates a new Microsoft Entra tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com.Solution: You instruct User4 to create the user accounts. Does that meet the goal?

Users are reporting that when they attempt to access myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an account name that ends with onmicrosoft.com. You discover that there is a UPN mismatch between Azure AD and the on-premises Active Directory. You need to ensure that the users can use single-sign-on (SSO) to access Azure resources. What should you do first?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that contains the following users in a Microsoft Entra tenant named contoso.onmicrosoft.com:User1 creates a new Microsoft Entra tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com.Solution: You instruct User2 to create the user accounts. Does that meet the goal?

Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The application calls a service on SRV02 by IP address.You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network.You need to configure the two VMs with static internal IP addresses. What should you do?

You have an Azure Subscription that contains a storage account named storageacct1234 and two users named User1 and User2.You assign User1 the roles shown in the following exhibit.Which two actions can User1 perform? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.A user named User1 has the following roles for Subscription1: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises ActiveDirectory domain.You have a server named DirSync1 that is configured as a DirSync server.You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller.Does the solution meet the goal?

You have 15 Azure subscriptions.You have a Microsoft Entra tenant that contains a security group named Group1. You plan to purchase additional Azure subscription.You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:Use the principle of least privilege. Minimize administrative effort.What should you do?

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.Subscription1 has a user named User1. User1 has the following roles: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

You have an Azure subscription.Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs.You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run Windows Server.You need to ensure that the connections to App1 are spread across all the virtual machines.What are two possible Azure services that you can use? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

You have an Azure subscription that contains the resources shown in the following table.You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.Which role should you assign?

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.A user named User1 has the following roles for Subscription1: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configuredas the usage model.After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the newemployees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.To achieve this, the Per Enabled User setting must be set for the usage model.Solution: You reconfigure the existing usage model via the Azure CLI.Does the solution meet the goal?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company has an Azure Active Directory (Azure AD) subscription.You want to implement an Azure AD conditional access policy.The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when theyconnect to Azure AD from untrusted locations.Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.Does the solution meet the goal?

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles; * Reader * Security Admin * Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1 to RG2.What is the effect of the move?

You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical requirements. What should you include in the recommended?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.To achieve this, the Per Enabled User setting must be set for the usage model.Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.Does the solution meet the goal?

You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).Which of the following should you use to create the virtual machine?

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.Subscription1 has a user named User1. User1 has the following roles: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

Which of the following charts is not supported by the query language?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company’s Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.VirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to-site VPN connection exists between your company’s on-premises network and VirtualNetworkA.You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company’s on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation.You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.Solution: You choose the Allow gateway transit setting on VirtualNetworkB. Does the solution meet the goal?

You have the Azure virtual machines shown in the following table.A DNS service is installed on VM1.You configure the DNS servers settings for each virtual network as shown in the following exhibit.You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.What should you do?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configuredas the usage model.After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the newemployees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.To achieve this, the Per Enabled User setting must be set for the usage model.Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.Does the solution meet the goal?

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.Subscription1 has a user named User1. User1 has the following roles: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.Does this meet the goal?

You have an Azure subscription that contains the resources shown in the following table.You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.Which role should you assign?