az104-labs-series

KO | EN

gitlite — search

#large-language-models #cpp #devops #ai-agent #electron #monitoring #machine-learning #command-line #nlp #proxy

az104-labs-series

(★ 9)

Azure Administator Associate Lab Series

File Explorer

ZIP Download

- - 14-vm-disk-snapshot.md
  - 15-vmss-autoscale.md
  - 16-app-service.md
- - 17-ad-ds-domain-controller.md
- - 18-recovery-services-vault.md
- - 01-nsg-asg.md
  - 02-vnet-peering.md
  - 03-load-balancer.md
  - 04-lb-outbound.md
  - 05-nat-gateway.md
  - 06-udr-nva.md
  - 07-application-gateway.md
  - 08-bastion.md
  - 09-traffic-manager.md
  - 10-private-endpoint-blob.md
  - 11-private-dns-links.md
- - 12-storage-security-lifecycle.md
  - 13-private-endpoint-files.md
- base-2vm-cleanup.ps1
- base-2vm.ps1
- Start-AllVMs.ps1
- Stop-AllVMs.ps1
- Verify-Shutdown.ps1
00-START-HERE.md
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

18 Azure labs, written up as step-by-step instructions instead of just a portfolio of what I built. I passed AZ-104 on August 7, 2026, and a few people asked for the lab docs after I mentioned them on Reddit — this is that, cleaned up enough for someone else to actually follow.

**→ [00-START-HERE.md](00-START-HERE.md)** has the setup and cost notes. Worth a quick read first.

---

## What's different from a Microsoft Learn tutorial

Each lab ends with something specific to check, not "confirm it deployed." The NAT Gateway lab isn't done when the gateway exists — it's done when you ask the VM what IP the internet sees and it matches the gateway's IP. The Private DNS lab isn't done when resolution works — it's done when you delete the link and get a timeout instead of an NXDOMAIN, and you can say why those are different.

A few labs also walk through breaking them on purpose, because that's usually where I actually understood what was going on.

---

## The labs

### Networking

| # | Lab | Time | Cost |
|---|---|---|---|
| 01 | [NSG + ASG: dual-layer filtering](labs/networking/01-nsg-asg.md) | 45m | ~$0.15 |
| 02 | [VNet peering](labs/networking/02-vnet-peering.md) | 20m | ~$0.02 |
| 03 | [Azure Load Balancer (L4)](labs/networking/03-load-balancer.md) | 60m | ~$0.20 |
| 04 | [Standard LB outbound vs NAT Gateway](labs/networking/04-lb-outbound.md) | 30m | ~$0.10 |
| 05 | [NAT Gateway for a private VM](labs/networking/05-nat-gateway.md) | 25m | ~$0.08 |
| 06 | [UDR + Network Virtual Appliance](labs/networking/06-udr-nva.md) | 40m | ~$0.10 |
| 07 | [Application Gateway, path-based routing](labs/networking/07-application-gateway.md) | 60m+ | ~$0.40 ⚠️ |
| 08 | [Azure Bastion](labs/networking/08-bastion.md) | 35m | ~$0.25 ⚠️ |
| 09 | [Traffic Manager DNS failover](labs/networking/09-traffic-manager.md) | 45m | ~$0.15 |
| 10 | [Private Endpoint for Blob Storage](labs/networking/10-private-endpoint-blob.md) | 50m | ~$0.10 |
| 11 | [Private DNS: what a VNet link actually does](labs/networking/11-private-dns-links.md) | 35m | ~$0.05 |

### Storage

| # | Lab | Time | Cost |
|---|---|---|---|
| 12 | [Storage firewall, SAS revocation, lifecycle policies](labs/storage/12-storage-security-lifecycle.md) | 75m | ~$0.05 |
| 13 | [Private Endpoint + Azure File Share](labs/storage/13-private-endpoint-files.md) | 45m | ~$0.08 |

### Compute

| # | Lab | Time | Cost |
|---|---|---|---|
| 14 | [Data disk, snapshot & restore](labs/compute/14-vm-disk-snapshot.md) | 40m | ~$0.10 |
| 15 | [VMSS autoscale](labs/compute/15-vmss-autoscale.md) | 55m | ~$0.20 |
| 16 | [App Service: deploy, logs, slot swap](labs/compute/16-app-service.md) | 40m | ~$0.02 |

### Identity & Hybrid

| # | Lab | Time | Cost |
|---|---|---|---|
| 17 | [AD DS on Azure VMs](labs/identity/17-ad-ds-domain-controller.md) | 2h | ~$0.40 |

### Monitor & Backup

| # | Lab | Time | Cost |
|---|---|---|---|
| 18 | [Recovery Services Vault: backup and teardown](labs/monitor-backup/18-recovery-services-vault.md) | 60m | ~$0.15 |

⚠️ = bills hourly whether you're using it or not — delete it as soon as you're done with it.

---

## Only have time for a few

**05, 10, 06, and 18.** They cover the mechanisms that show up most on the exam and in actual work, and each one ends with a clear yes/no check instead of "looks right, I guess."

If you're brand new to Azure, start with **05** — it's short and the verification is one number matching another number.

---

## Scripts

| Script | What it does |
|---|---|
| [`base-2vm.ps1`](scripts/base-2vm.ps1) | Spins up the base topology most labs start from — 1 VNet, 2 subnets, 2 Windows VMs |
| [`base-2vm-cleanup.ps1`](scripts/base-2vm-cleanup.ps1) | Tears it down |
| [`Start-AllVMs.ps1`](scripts/Start-AllVMs.ps1) | Starts every VM in the RG |
| [`Stop-AllVMs.ps1`](scripts/Stop-AllVMs.ps1) | Deallocates every VM, cleans up public IPs |
| [`Verify-Shutdown.ps1`](scripts/Verify-Shutdown.ps1) | Confirms billing actually stopped |

Everything else — the actual configuration each lab is teaching — happens in the portal.

---

## What's not here

No Azure File Sync or Log Analytics lab. Neither was available in the subscription I built these in, so rather than write steps I never actually ran, they're just not included.

The App Service lab was built without notes at the time, so it's reconstructed rather than transcribed — flagged in that file. Everything else here is written from an actual run.

---

## If something's wrong

Azure moves. If a step doesn't match what you're seeing, open an issue or a PR. A couple of things in here were already wrong in my own notes and got corrected against Microsoft Learn while writing this up — the Bastion NSG rule set (it's eight rules, not two) and a routing-rule field in Application Gateway I'd missed entirely.

Use it, fork it, change it. If it helps, put your own version up too.

az104-labs-series

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README