Microsoft Azure Administrator (AZ-104) - Compute, Storage & Networking

• Microsoft Entra ID: Cloud-based identity and access management service using HTTP/HTTPS protocols (OAuth 2.0, OpenID Connect, SAML) with a flat structure.
• AD DS: Traditional on-premises directory service using Kerberos/NTLM authentication and hierarchical Organizational Units (OUs).

An authorization system built on Azure Resource Manager that provides fine-grained access management. Consists of three elements:
1. Security Principal: User, group, service principal, or managed identity.
2. Role Definition: List of allowed/denied permissions (actions and notActions).
3. Scope: Management Group, Subscription, Resource Group, or Resource.

• Azure RBAC: Focuses on user actions (who has permission to create, update, or delete resources).
• Azure Policy: Focuses on resource properties (enforces compliance standards, such as allowed VM SKUs or mandatory tags, regardless of user permissions).

• LRS (Locally Redundant Storage): 3 copies within a single physical data center (99.11 9s durability).
• ZRS (Zone-Redundant Storage): 3 copies across 3 availability zones in the primary region.
• GRS (Geo-Redundant Storage): LRS in primary region + LRS in a secondary paired region (300+ miles away).
• GZRS (Geo-Zone-Redundant Storage): ZRS in primary region + LRS in secondary region.

• Hot: Frequently accessed data; highest storage cost, lowest access cost.
• Cool: Infrequently accessed data (min. 30 days retention); lower storage cost, higher access cost.
• Cold: Rarely accessed data (min. 90 days retention); lower storage cost than Cool.
• Archive: Offline data (min. 180 days retention); lowest storage cost, highest access cost. Requires rehydration (hours).

A URI that grants delegated, time-bound access rights to Azure Storage resources without exposing account keys.
• User Delegation SAS: Secured with Entra ID credentials (best practice).
• Service SAS: Secured with storage account key; grants access to a specific service (Blob, Queue, File, Table).
• Account SAS: Secured with storage account key; grants access to resources across multiple services.

A logical grouping of VMs that distributes workloads across multiple physical hardware nodes to protect against hardware failures and updates.
• Fault Domains (FD): Share common power and network switch (protects against hardware failure).
• Update Domains (UD): Group of VMs that can be rebooted together during maintenance.
• Provides a 99.95% SLA.

Physically separate data center locations within an Azure region, each with independent power, cooling, and networking.
• Protects against entire data center failures.
• Provides a 99.99% VM availability SLA when deployed across 2+ Availability Zones.