AZ-700 vs AZ-104: Which Azure Certification Should You Take First?

AZ-700 vs AZ-104 comes down to scope: AZ-700 certifies you to design and run Azure networking specifically, while AZ-104 certifies you to administer the whole Azure estate, of which networking is one slice. Both are associate-level exams with a 700 passing score on a 1 to 1000 scale, both allot 100 minutes, both cost typically US$165 in the United States, and neither has a formal prerequisite. If your job is routes, firewalls and connectivity, take AZ-700. If you run subscriptions, identities, storage and compute alongside the network, take AZ-104 first. Most people should take AZ-104 first anyway, and this article explains why, plus the cases where jumping straight to AZ-700 is the right call.

AZ-700 vs AZ-104 side by side

What each exam actually tests

AZ-104 is a generalist paper. Its five domains cover identities and governance, storage, compute, virtual networking, and monitoring and backup. The networking domain exists, but it stays at the level a general administrator needs: create VNets, configure peering, write NSG rules, attach a load balancer. It is wide and moderately shallow by design, because the Azure Administrator role is wide and the deep work gets delegated to specialists.

AZ-700 picks up where the AZ-104 networking domain stops and goes down. Its five domains are core networking infrastructure (25 to 30 percent), connectivity services (20 to 25 percent), application delivery (15 to 20 percent), network security services (15 to 20 percent) and private access to Azure services (10 to 15 percent). In its roughly 1,400-word outline, firewall appears 13 times, ExpressRoute and VPN 11 times each. The exam expects you to choose between ExpressRoute peering types, design Virtual WAN topologies, place workloads correctly across Load Balancer, Application Gateway, Front Door and Traffic Manager, and get private endpoint DNS resolution exactly right. None of that is on AZ-104.

Which should you take first?

Take AZ-104 first if you administer Azure broadly. The AZ-700 audience profile expects hands-on Azure networking experience, and AZ-104 is where most people acquire the platform fundamentals: how RBAC actually gates operations, how subscriptions and resource groups shape design, how monitoring hangs together. AZ-700 assumes all of it silently. Learning ExpressRoute before you can confidently explain a route table's effective routes is doing the curriculum backwards.

Go straight to AZ-700 if you are already a network engineer. If you carry years of routing, switching and firewall experience and your company is moving connectivity into Azure, you do not need the identity and storage domains of AZ-104 to justify your seat. Your gap is the Azure service catalog, not networking itself, and AZ-700 tests exactly that gap. This is the one persona for whom skipping AZ-104 is clearly right.

Take both if you want the network engineer role title. Job listings for Azure network engineers frequently ask for AZ-104 or equivalent experience plus AZ-700, and screening software, human or AI recruiters alike, matches on certification names before anyone reads your project history. The pair together signals both platform fluency and specialist depth, which is the actual shape of the job.

Is AZ-700 harder than AZ-104?

For most candidates, yes, but for a specific reason: depth of decisions rather than volume of material. AZ-104 difficulty comes from breadth across unrelated services; you study more topics, but each question tends to have one clearly best answer once you know the service. AZ-700 questions more often present two defensible designs that differ in a detail: policy-based versus route-based VPN, private endpoint versus service endpoint, WAF on Application Gateway versus Front Door. Network engineers who live in these decisions daily rate AZ-700 the easier of the two. Everyone else should expect it to demand more careful preparation, and both exams punish console-avoidance equally.

Do AZ-104 and AZ-700 overlap?

About one domain's worth. AZ-104's virtual networking objectives (VNets, peering, NSGs, basic load balancing, DNS basics) reappear in AZ-700's core infrastructure domain at three times the depth. If you passed AZ-104 recently, that overlap is a genuine head start: budget your AZ-700 study time for ExpressRoute, Virtual WAN, the application delivery lineup and Private Link, the areas AZ-104 never touched. Working through the shared topics again at AZ-700 depth also firms up knowledge the associate exam let you skate on.

What changed on each exam in 2026

Neither exam moved much this year, which is good news for anyone using slightly older study material. AZ-104's outline refresh of April 17, 2026 graded every objective group No change. AZ-700's refresh takes effect July 27, 2026 with the listed updates graded Minor, confined to IP addressing, network monitoring and NSG objectives, and the rest No change; no domains or weights moved on either exam. Contrast that with the churn elsewhere in the Microsoft catalog in 2026, where MD-102 gained a whole new automation domain and several exams retired outright. Stability matters when you are sequencing two exams: you can plan an AZ-104 then AZ-700 path across several months without worrying that the second blueprint will shift under you mid-preparation.

One practical implication of the AZ-700 monitoring tweak: expect Network Watcher, connection troubleshooting and flow logs to be live exam material, not an afterthought. Candidates who only learn design-time services and skip the operational tooling leave points on the table in a domain they cannot afford to, given the flat weighting.

How to prepare for either one

The method is the same; only the source material changes. Pull the official study guide for your exam plus your own notes into a question generator and drill by domain: the AZ-700 practice test page covers the networking exam and the AZ-104 practice test page covers the administrator one. Weight your questions the way the blueprint weights domains, watch where your wrong answers cluster, and close each gap before moving on. Both exams have a free official practice assessment on Microsoft Learn; treat a comfortable pass there as your booking signal. Any other exam on your path works through the certification exam generator.

The bottom line

AZ-104 is the default first Azure certification: it builds the platform context everything else assumes, and its Azure Administrator Associate title matches more job descriptions. AZ-700 is the right specialist move once connectivity is your actual job, and the right first exam only for experienced network engineers crossing into Azure. Both renew free every 12 months with an online assessment, so whichever you pick, the decision cost is one exam fee and a few weeks of honest preparation. After AZ-700, architects tend to continue to AZ-305, where the networking half of the design content will already feel familiar.