5 AZ-104 Topics That Catch Most Candidates Off Guard

The AZ-104 is not a memorisation exam. It's a reasoning exam. Most candidates who fail don't fail because they didn't study — they fail because the exam tests edge cases, exceptions, and interactions between services that documentation explains individually but never shows you together. These are the five topics that consistently expose that gap. 1. Management-Plane vs Data-Plane RBAC (Domain 01) This is the single most tested distinction in the identity and governance domain, and it's the one that feels obvious until the exam puts it in a scenario. Here's the trap: a user has the Storage Account Contributor role. Can they read blob data from the storage account? No. Storage Account Contributor is a management-plane role — it lets you manage the storage account itself (configure settings, view keys, manage network rules). It does not grant access to the data inside it. To read blob data, you need a data-plane role: Storage Blob Data Reader or Storage Blob Data Contributor. Now the seco