WELCOME

AZ-104: Microsoft Azure Administrator — Exam Skills Checklist Use this as a self-assessment tracker. For each bullet, rate yourself: ✅ confident ⚠️ shaky ❌ haven't touched it 1. Manage Azure Identities and Governance — 20–25% Manage Microsoft Entra users and groups Create users and groups Manage user and group properties Manage licenses in Microsoft Entra ID Manage external users Configure self-service password reset (SSPR) Manage access to Azure resources Manage built-in Azu

Configure and manage virtual networks in Azure — 12 questions 1. You create a VNet with address space 10.0.0.0/16. Which pair of subnet ranges is valid and non-overlapping? A. 10.0.1.0/24 and 10.0.1.128/25 B. 10.0.1.0/24 and 10.0.2.0/24 C. 10.0.1.0/24 and 10.1.2.0/24 D. 10.0.0.0/16 and 10.0.2.0/24 2. How many IPv4 addresses are assignable to resources in a typical Azure /24 subnet after Azure’s reserved addresses are excluded? A. 254 B. 256 C. 250 D. 251 3. A VM requires two

Implement and Manage Virtual Networking — 15–20% of exam Configure and manage virtual networks in Azure Create and configure virtual networks and subnets Create and configure virtual network peering Configure public IP addresses Configure user-defined routes Other Azure Network Topics (Express Route) Azure Virtual WAN File share settings, configure identity-based access for storage Azure network performance Optimizations and Redundancy Troubleshoot network connectivity Config

The template has 31 subsections and 165 sub-subsection items across its nine major sections. Major section Subsections Sub-subsection items 1. Executive Summary and Strategic Intent 2 17 2. Governance, Scope, and Accountability 4 19 3. CEM and THIRF Strategic Outcomes 3 14 4. Baseline Logging Strategy and Coverage Posture 4 14 5. Mission/Risk-Based Prioritization 3 17 6. Enterprise Logging and Data Strategy 4 17 7. Security, Privacy, Integrity, and Resilience 4 17 8. Validati

Exam domain: Implement and Manage Storage (15–20%) This module covers Azure Storage fundamentals, configuration, access control, data protection, and administration. The core configuration sections align with Microsoft’s current AZ-104 storage objectives; service selection, cost optimization, cybersecurity, and labs provide supporting practical knowledge. 1. Azure Storage Fundamentals Overview of Azure Storage services and storage accounts Introduction to Blob Storage, Azure

1. Section 1 — Azure Storage Fundamentals Which Azure Storage service is designed to store application messages for asynchronous processing? A. Azure Files B. Azure Queue Storage C. Azure Blob Storage D. Azure Table Storage 2. Section 2 — Choosing the Right Storage Solution An organization needs to store frequently accessed documents and provide full-text search across their contents. Which solution best meets this requirement? A. Azure Files with share snapshots B. Blob Stor

Writing a Detection: Overview The core of a detection is its analytic logic: the conditions used to evaluate organizational telemetry and identify activity that may be malicious, suspicious, or inconsistent with expected behavior. Detection logic may use one or more analytic methods, including: Matching a specific string, command, file path, event ID, or field value Combining multiple strings, fields, events, or log sources Correlating related activity across identities, endp

Detection Engineering Design Philosophies At this point in the course, it is useful to take a quick beyond the detection development process and go beyond detection engineering form and process. It is critical to examine the underlying philosophies that make detections more effective, resilient, and operationally valuable. Some detection design requirements are straightforward. As discussed previously, frameworks such as Palantir’s Alerting and Detection Strategy (ADS) estab

Detection Engineering Program: High-Level Frameworks As detection engineering has matured, practitioners have developed frameworks to make detection programs more structured, consistent, and measurable. One of the earliest influential models was Palantir’s Alerting and Detection Strategy (ADS) Framework, introduced nearly a decade ago and subsequently refined. The Problem: Inconsistent Detection Practices Historically, many organizations developed custom detections without a

What detections do I create? A simple answer to this question is, create detections for things you don't have detections for! the harder part of answering this main question is two fudnnamteal questions that udnerpoin it: what do I have detections for? What do I detcetions do I need? Threat Analysis and Identifying Detection Gaps Support Incident response Cyber Threat Intelligence Threats Exposure Gaps & Cyber Threat Intelligence Threat Hunt Missions Five reasons for creating

!!!Note: this is learning Notes, some AI slop. KQL needs to be tested!!! Detecting Microsoft CoPilot Abuse Patterns Because most of these techniques abuse legitimate Copilot functionality rather than exploiting a classic software vulnerability, detection has to shift from "block the bad traffic" to "baseline normal Copilot behavior and flag deviation. Purview / Copilot audit log analysis Monitor for Copilot interactions that retrieve sensitive-labeled content (per Microsoft P

Brief Overview of How Microsoft 365 Copilot Works Microsoft Copilot is an AI-powered processing and orchestration engine that combines several Microsoft technologies to deliver contextual productivity assistance. At a high level, Copilot coordinates three key components: Large Language Models (LLMs) — provide the AI reasoning and natural-language processing capabilities. Microsoft Graph — provides access to organizational context, including emails, chats, documents, meetings,

How Abuse of Microsoft Copilot Maps to the Attack Matrices MITRE ATLAS (atlas.mitre.org) Mitre Atlas is the ATT&CK-style knowledge base purpose-built for adversarial tactics against AI/ML systems. As of the current release it organizes techniques into 16 tactics run in rough attack-progression order: Reconnaissance → Resource Development → Initial Access → AI Model Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lat

Scheduled Tasks Overview and Impact to Cybersecurity Running scheduled tasks is a fundamental part of Windows system administration. Organizations routinely use scheduled tasks to automate activities that need to occur at specific times or in response to specific system events. Common examples include running scripts, performing system maintenance, checking system health, generating reports, cleaning up temporary files, and executing backup or update routines. However, like m

Palantir Technologies — Overview Palantir is a data-analytics and AI software company founded in 2003, originally built for U.S. intelligence and counterterrorism work before expanding into commercial enterprise markets. Its core pitch: help large, complex organizations integrate messy, siloed data and turn it into operational decisions, not just dashboards, but software that can trigger real-world actions. Palantir organizes its offering around four principal software platfo

KQL Numeric and Comparison Operators KQL provides a standard set of arithmetic and comparison operators used for calculations and filtering: Arithmetic Operators (return numeric values) + Addition - Subtraction * Multiplication / Division % Modulo (remainder) These are commonly used for: Rate calculations (e.g., bytes/sec) Data normalization Threshold comparisons Comparison & Membership Operators (return boolean values) > Greater than < Less than >= Greater tha

KQL Essentials: Variables with let and Arrays with dynamic Kusto Query Language (KQL) supports variables using the let statement, which allows you to store values, expressions, or entire subqueries for reuse within a query. This enhances readability, reduces duplication, and improves maintainability of complex queries. Using let to Create Variables The let statement follows this basic format: let VariableName = ExpressionOrValue; Key Components of let statement: let – Keyword

Project Project lets you change values on output. Other options with project are 'project-away', 'project-keep', 'project-rename' (allows you to map an original field to its normalized name. this operator ensures that the field is still managed as a physical field and that handling the field is more performant)., 'project-reorder'. | project FreeGB=CounterValue / 1024 Other project ideas: | project <NewColumnName1> = <ExistingColumnName1>, <NewColumnName2> = <ExistingColumn

Summarize and Count Simple Sorts: | sort by fieldname asc //or | sort by fieldname desc Simple Summarize: | summarize by fieldname desc Adding summarize and then counting" | summarize count () by fieldname Different example: | summarize count() by columname1, columnname2 | sort by count_ Other option for summarize and count and then filtering the output to only counts over certain limits. | summarize EventCount = count() by fieldname | where EventCount > 1000 To see the 1st v

Diving into Scalars & String Predicates in KQL Now that we’ve covered how to view table schemas, perform basic searches, and filter logs by time, it’s time to go deeper into scalar operations and string matching in Kusto Query Language (KQL), key building blocks for powerful filtering. Types of KQL Statements Tabular Expressions – Return result sets (e.g., rows/columns from tables). Scalar Expressions – Return single values used in filters, projections, calculations. What Are