Microsoft AZ-104 (Azure Administrator)

A help desk ticket reads: "I'm a Global Administrator and I still can't restart the VM." The fix starts with knowing that Azure has two separate permission systems, and that this person holds a role in only one of them.

• Microsoft Entra ID is the identity directory: users, groups, applications, devices, sign-in and the Microsoft Entra roles that administer the directory itself (Global Administrator, User Administrator, Groups Administrator, License Administrator and others). A tenant is one instance of Entra ID for one organization.
• Azure role-based access control (Azure RBAC) governs Azure resources: subscriptions, resource groups, VMs, storage accounts. Its Azure roles (Owner, Contributor, Reader and many resource-specific roles) are assigned at a scope in the resource hierarchy. Every subscription trusts exactly one tenant for its identities.

The systems are linked but not merged. A Global Administrator manages the directory; by default that role grants no access to Azure resources. For emergencies, a Global Administrator can turn on Access management for Azure resources (on the Microsoft Entra ID Properties page in the Entra admin center; labels have moved before, so search for the setting name if the path differs). Microsoft's documentation (updated March 2025) says this grants the User Access Administrator role at root scope (/), which allows viewing all resources and assigning access in every subscription and management group in the tenant. It doesn't directly grant the ability to restart a VM; the administrator would then assign a role, which is itself a logged change. The elevation is recorded in Microsoft Entra audit logs (service "Azure RBAC (Elevated Access)," in preview at the time of writing) and in Azure activity logs. Microsoft says to turn it back off once the root-scope work is done. Treat any use of it as an event someone reviews.

The ticket, resolved: the user needs an Azure role, such as Virtual Machine Contributor, assigned at the right scope. Raising their Entra role would change nothing about the VM.

AZ-104's Manage Azure identities and governance domain (20–25% of the exam in the skills outline dated April 17, 2026) covers both planes: managing Entra users, groups, licenses, external users and self-service password reset, and managing access to Azure resources. Policy, locks, tags, subscriptions, costs and management groups from the same domain are taught in Azure Governance at Scale: Policy, Management Groups & Cost Controls; this module stays on identity and access.