Why Azure Administrator Candidates Struggle With Cross-Service Integration (And How to Fix It Before Your Exam)

You’ve studied RBAC. You understand VNets. You can explain NSGs in your sleep. But when the exam question asks you to configure a multi-service scenario—where an App Service needs to access a Storage Account through a Key Vault while respecting Azure AD permissions and NSG rules—everything falls apart. This is the exact moment most Azure Administrator candidates fail the AZ-104 exam, and it’s not because you lack knowledge. It’s because you’re missing the architecture that connects these services together.

Direct Answer

The hardest topics on the Microsoft Azure Administrator (AZ-104) exam aren’t individual services—they’re the integration scenarios that require you to understand how RBAC, VNets, NSGs, Storage Accounts, App Service, Azure AD, and Key Vault work together as a single security and access system. Most candidates study each service in isolation, then freeze when the exam presents a real-world scenario requiring decisions across multiple services simultaneously. The root cause is a conceptual gap: you understand what each tool does, but not why it matters when connecting services together. Exam success on AZ-104 requires mastering not just Azure components, but the decision logic that connects them.

Why This Happens to Microsoft Azure Administrator Candidates

The AZ-104 exam is deliberately designed to test cross-service thinking. Microsoft isn’t asking, “What is RBAC?” They’re asking, “You need to grant a managed identity permission to access a storage account, but only from a specific subnet, and only after authentication through Azure AD. What five things do you configure, in what order, and why?”

This is fundamentally different from studying isolated topics.

When you prepare using topic-by-topic resources, you create mental silos. RBAC becomes “role assignments.” VNets become “subnet ranges.” NSGs become “inbound rules.” Storage Accounts become “blob containers.” Each piece lives separately in your head. But real Azure deployments don’t work this way. A production system requires decisions that span all these areas simultaneously.

The exam tests this by creating scenarios where:

• RBAC and Azure AD decisions affect what identities can do. But those identities still need network access, which NSGs control. If you grant RBAC permission without considering NSG rules, the answer is incomplete.

• Key Vault permissions use RBAC, but the vault itself sits in a VNet. An App Service trying to retrieve secrets must have both the correct role assignment AND the ability to reach the vault’s network endpoint. Candidates who studied these separately don’t see the dependency.

• Storage Accounts enforce access through RBAC, firewall rules, and SAS tokens—sometimes simultaneously. A single scenario might require all three working together. Miss one, and your solution fails in production and on the exam.

• App Service integration scenarios demand decisions about managed identities, VNet integration, private endpoints, and authentication flows. This requires you to understand not just what each feature is, but which feature solves which specific part of the problem.

Most candidates fail not because they don’t know what NSGs do. They fail because they don’t automatically think about NSGs when solving a Key Vault access problem, even though NSGs are directly relevant.

The Root Cause: Conceptual Gaps in Cross-Service Integration Scenarios

The real problem is that your study approach mirrors the exam’s structure but misses the exam’s actual logic.

Official Microsoft Learn modules are organized by service. You complete the “RBAC” module, the “VNet” module, the “Storage” module. This is efficient for learning individual concepts. But it’s a terrible foundation for integration scenarios.

Your brain needs a different mental model: the security and access decision tree.

Every Azure deployment problem can be broken down into four layers that must work together:

1. Identity and authentication layer (Azure AD, managed identities, service principals)
2. Authorization layer (RBAC role assignments, Azure AD conditions, resource permissions)
3. Network layer (VNets, subnets, NSGs, service endpoints, private endpoints)
4. Service-specific access controls (Storage firewalls, Key Vault policies, App Service authentication)

The exam tests your ability to move through all four layers for a single scenario. A candidate with isolated topic knowledge might handle layers 1 and 2. A candidate without the integration framework struggles with layer 3, and fails to connect it back to layer 4.

Here’s the specific gap: When you see the word “Key Vault” in a scenario, your mind jumps to “RBAC role assignments and access policies.” That’s correct. But an experienced Azure administrator’s brain simultaneously thinks: Is this Key Vault in a VNet? If so, are the client applications on an approved subnet? Do we need a private endpoint? Is there an NSG blocking port 443? Do we need a service endpoint? These aren’t separate questions. They’re parts of a single decision.

The gap exists because nobody explicitly taught you to ask these questions in sequence. Your study materials covered each topic separately. The exam expects you to synthesize them.

How the Microsoft Azure Administrator Exam Actually Tests This

The AZ-104 exam uses a specific testing pattern for integration scenarios. The vendor isn’t testing breadth—they’re testing depth of understanding about how services interact.

Typically, the scenario will:

1. Describe a business requirement that naturally spans multiple services
2. Provide context about network topology, identity requirements, and access constraints
3. Ask you to make a decision that requires understanding all layers
4. Include distractor answers that are technically correct in isolation but incomplete in context

The vendors are measuring: Can you look at a real-world problem and immediately identify which Azure services are involved, what decisions each one requires, and how those decisions interact?

This is why candidates with perfect module scores sometimes fail. They can answer “What is RBAC?” but freeze on “Configure RBAC AND NSGs AND Key Vault access for this scenario.”

Example scenario:

Your company has an App Service that needs to read secrets from a Key Vault and access files in a Storage Account. The Storage Account and Key Vault must not be accessible from the public internet. The App Service runs on a Standard App Service Plan. All resources are in the same resource group and region.

Which approach is correct?

A) Create a user-assigned managed identity, assign it the “Key Vault Secrets User” role on the Key Vault and “Storage Blob Data Reader” role on the Storage Account, then enable VNet integration on the App Service to the same subnet as the Key Vault and Storage Account.

B) Create a user-assigned managed identity, assign it the “Key Vault Administrator” role, disable public access on both services, and configure the App Service authentication to use the managed identity.

C) Create a system-assigned managed identity, enable managed identity on the App Service, assign it the “Key Vault Secrets User” and “Storage Blob Data Reader” roles, configure private endpoints for both the Key Vault and Storage Account, add the App Service subnet to both services’ firewall whitelist, and disable public internet access.

D) Enable Key Vault and Storage Account firewalls, configure role assignments for the App Service identity, and manually create NSG rules blocking all internet traffic.

Why candidates pick the wrong answer:

• A is incomplete. VNet integration alone doesn’t solve private access; you need firewall rules and/or service endpoints.
• B sounds authoritative (“Administrator role”), but grants excessive permissions and doesn’t address network isolation.
• D looks comprehensive but NSG rules alone don’t create private endpoints or configure service firewall rules correctly.
• C is correct because it addresses all four layers: identity (managed identity), authorization (specific role assignments), network (private endpoints + firewall rules), and service-level access.

Most candidates picking A or B have studied RBAC and managed identities but haven’t internalized the network layer requirements. Those picking D have studied NSGs and firewalls but don’t understand that NSGs alone aren’t sufficient for private access in this scenario.

How to Fix This Before Your Next Attempt

1. Stop studying by service. Start studying by scenario.

Your next study session should not be “Review Key Vault.” It should be “Secure a web app that accesses a storage account.” Map out every Azure decision:

• What identity mechanism? (system-assigned or user-assigned managed identity)
• What role assignments? (be specific: “Key Vault Secrets User,” not just “access”)
• What network topology? (same VNet, private endpoints, or service endpoints?)
• What firewall rules? (IP, service endpoints, or private endpoints?)
• What Azure AD conditions? (if applicable)

Write this down as a decision tree, not as a list. Decision trees force you to see