Objective ↔ Vault Coverage Matrix
This is a structural map, not proof that the vault is self-contained. It maps the major published objective groups to the best matching vault artifacts. For the evidence-based comparison, see Source-to-Vault Audit. A green concept link means the idea is explained; it does not mean that a learner has demonstrated the skill in a lab or that every sub-objective is covered.
Audit baseline: AZ-104 study guide, effective April 17, 2026 and AZ-400 study guide, effective July 27, 2026. Re-audit after either guide changes.
Status legend:
- ✅ explained — a current note exists and was spot-checked for the named idea
- 🟡 partial — present, but lacks one or more explicit sub-objectives, a procedure, troubleshooting, or practice
- 🔴 missing — no adequate artifact found
- ✏️ corrected — a factual statement was corrected; it still needs normal review
AZ-104 — Azure Administrator
Domain 1 · Manage Azure identities & governance
| Microsoft objective | Vault coverage | Status |
|---|---|---|
| Microsoft Entra ID users, groups | user-account, groups, module create-configure-manage-identities, identity scenarios | ✅ explained + practised |
| License management | license-management, az104-identity-governance-lab, az104-q-identity-006 | ✅ explained + practised |
| External / guest users (B2B) | user-account, az104-identity-governance-lab, az104-q-identity-007, az104-q-identity-021 | ✅ explained + practised |
| Built-in Microsoft Entra roles + interpreting assignments | azure-ad-roles, role-assignment, az104-q-identity-014, az104-q-identity-020 | ✅ explained + practised |
| SSPR & MFA | password-reset, mfa (both ✏️ fixed) | ✅ |
| Browse & query directory / settings | entra-directory-management, module create-configure-manage-identities | ✅ explained + practised |
| RBAC assignments, scopes, inheritance (additive) | rbac, scope, role-assignment (✏️ fixed) | ✅ |
| Azure Policy (Deny/Audit/initiatives) | azure-policy | ✅ |
| Resource locks | resource-locks | ✅ |
| Resource groups (create/delete/organize) | resource-group, module manage-subscriptions-governance, az104-q-identity-018 | ✅ explained + practised |
| Tags (with limits) | resource-tags (✏️ fixed) | ✅ |
| Management groups | management-groups, az104-q-identity-017, az104-q-integrated-005 | ✅ explained + practised |
| Subscriptions / cost management / budgets | subscription, azure-cost-management, az104-q-identity-015, az104-q-identity-016 | ✅ explained + practised |
| Azure Advisor cost recommendations | azure-advisor | ✅ |
Domain 2 · Implement & manage storage
| Objective | Coverage | Status |
|---|---|---|
| Storage account kind / tier / redundancy | storage-account, redundancy-lrs-zrs-grs | ✅ |
| Blob & container management | blob-storage, module blob-storage | ✅ |
| Object replication | object-replication | ✅ |
| Lifecycle management / access tiers | access-tier, az104-q-store-010 | ✅ explained + practised |
| Blob versioning / soft delete | blob-versioning | ✅ |
| Azure Files SMB identity-based access | azure-files, az104-q-store-007, az104-q-store-014, embedded storage labs | ✅ explained + practised |
| Azure Files snapshots / soft delete | file-snapshots, blob-versioning | ✅ |
| Stored access policies + SAS | sas-token, stored-access-policy, az104-q-store-006, az104-q-store-013, embedded storage labs | ✅ explained + practised |
| Storage-account encryption | storage-encryption | ✅ |
| Storage access keys / connection strings | storage-access-keys | ✅ |
| Storage network rules / firewall / private endpoints | storage-network-rule, module storage-security | ✅ |
| Storage Explorer | storage-browser | ✅ |
| AzCopy data movement | azcopy | ✅ |
Domain 3 · Deploy & manage compute
| Objective | Coverage | Status |
|---|---|---|
| VM create/configure (sizes, disks) | azure-vm, vm-sizes, managed-disks | ✅ |
| VM availability (set vs zones vs VMSS) | availability-set, availability-zones, virtual-machine-scale-set | ✅ |
| VM movement | vm-move | ✅ |
| VM encryption-at-host / EncryptionAtHost | vm-encryption-at-host | ✅ |
| VM extensions / custom script | azure-vm-extension | ✅ |
| App Service plans & slots | app-service-plan, deployment-slots | ✅ |
| App Service TLS / certificates / custom domains | app-service-tls-custom-dns | ✅ |
| App Service backup / networking | app-service-backup, app-service-networking | ✅ |
| ACR (Azure Container Registry) | acr | ✅ |
| ACI (Container Instances) sizing/scaling | aci, az104-q-compute-019, embedded compute labs | ✅ explained + practised |
| Azure Container Apps | azure-app-container-apps, az104-q-compute-006, az104-q-compute-020 | ✅ explained + practised |
| ARM / Bicep templated deployments | arm, bicep, arm-template, az104-q-compute-021 | ✅ explained + practised |
| AKS / Functions (re-weighted in 2026) | aks, azure-functions | ✅ context only; neither is a named current AZ-104 compute objective |
Domain 4 · Implement & manage virtual networking
| Objective | Coverage | Status |
|---|---|---|
| VNet + subnets + IP addressing / public IPs | vnet, subnet, cidr-ip-addressing, public-ip-address, az104-network-private-access-lab, az104-q-net-016 | ✅ explained + practised |
| VNet peering | vnet-peering (✏️ question fixed) | ✅ |
| Route tables / UDR | route-table | ✅ |
| NSG / ASG / effective rules | nsg, asg, effective-nsg-rules, az104-network-private-access-lab | ✅ explained + practised |
| Azure DNS / Private DNS | azure-dns, private-dns | ✅ |
| VPN Gateway / ExpressRoute / VWAN | vpn-gateway, expressroute, virtual-wan | ✅ explained (context; not a current explicit AZ-104 sub-objective) |
| Load Balancer / App Gateway / Traffic Manager / Front Door | load-balancer, application-gateway, traffic-manager, azure-front-door | ✅ |
| Azure Firewall / DDoS | azure-firewall, ddos-protection | ✅ |
| Network troubleshooting (Network Watcher, connection monitor) | network-watcher, connection-monitor, az104-network-private-access-lab | ✅ explained + practised |
Domain 5 · Monitor & maintain resources
| Objective | Coverage | Status |
|---|---|---|
| Azure Monitor (metrics, logs, activity log) | azure-monitor, azure-monitor-metrics, azure-monitor-activity-log, log-analytics | ✅ |
| KQL queries | kql | ✅ |
| Alerts + alert processing rules | metric-alert, action-group, alert-processing-rules | ✅ |
| Azure Monitor Insights (VM/storage/network) | azure-monitor-insights | ✅ |
| Workbooks | workbooks | ✅ |
| Azure Backup + Backup vaults / reports | azure-backup, recovery-services-vault, backup-vault, backup-reports, az104-backup-recovery-lab | ✅ explained + practised |
| Azure Site Recovery / DR | azure-site-recovery | ✅ |
AZ-400 — DevOps Solutions
All eight published AZ-400 paths are now reachable from Home. The table maps the five high-level domains plus the blueprinted weight (build/release = 50–55%).
Domain 1 · Design & implement processes & communications (≈)
| Objective | Coverage | Status |
|---|---|---|
| Flow of work, feedback, traceability | 0-processes-communications-moc, github-flow, devops-traceability, process-domain scenarios | ✅ explained + practised |
| Metrics, queries, dashboards | devops-flow-metrics, module measure-devops-flow, instrumentation scenarios | ✅ explained + practised |
| Documentation, webhooks, Boards/GitHub, communication | docs-as-code, devops-collaboration-integration, github-issues-projects, webhooks, process-domain scenarios | ✅ explained + practised |
Domain 2 · Source control strategy
| Objective | Coverage | Status |
|---|---|---|
| Git, branching, PRs, conflicts | git, branching-strategy, pull-request, merge-conflict | ✅ |
| GitHub + Azure Repos integration | github, azure-repos, source-control scenarios | ✅ explained + practised |
| Large files / repo sizing / GitHub-Azure DevOps identities | git-repository-scaling, devops-platform-authentication, secretless-pipeline-authentication, source-control scenarios | ✅ explained + practised |
Domain 3 · Build & release pipelines (50–55%)
| Objective | Coverage | Status |
|---|---|---|
| YAML pipelines | pipeline-yaml, pipeline-run, [[20-az400/2-ci-azure-pipelines-gh-actions/advanced-yaml-pipelines | advanced YAML pipeline module]] |
| Agents / pools / self-hosted | agent-pool, self-hosted-agent, module pipeline-security-controls | ✅ |
| Templates / steps / jobs | jobs-steps, pipeline-templates, module pipeline-components-and-stage | ✅ |
| Build & test (unit/integration) | build-artifact, ci-trigger, [[20-az400/2-ci-azure-pipelines-gh-actions/pipeline-integration-tests | pipeline integration-test module]], test-coverage |
| Deployment strategies (blue-green/canary/rings/gates/rollback) | blue-green-deployment, canary-deployment, deployment-ring, deployment-gate, rollback-strategy, deployment-automation | ✅ |
| Service connections / workload identity | subscription-connection, workload-identity-federation | ✅ |
| Release management / approvals | environment-approvals, dynamic-approval-checks, deployment-environment, az400-azure-pipelines-controlled-delivery-lab, build/release scenarios | ✅ explained + practised |
| GitHub Actions as an alternative | github-actions, modules use-github-actions-for-ci, branch-protection-and-policies | ✅ |
Domain 4 · Infrastructure as Code
| Objective | Coverage | Status |
|---|---|---|
| Bicep / ARM / Terraform | bicep, arm-template, terraform | ✅ |
| Desired state / drift | desired-state, azure-machine-configuration, configuration-drift | ✅ explained |
| IaC in pipelines / on-demand environments | infrastructure-as-code, provisioning-pipeline, azure-deployment-environments, build/release scenarios | ✅ explained + practised |
Domain 5 · Security / instrumentation
| Objective | Coverage | Status |
|---|---|---|
| Secrets (Key Vault) + variable groups / secretless auth | key-vault, secrets-management, variables-groups, pipeline-security, secretless-pipeline-authentication, security scenarios | ✅ explained + practised |
| SAST / DAST / dependency & secret scanning | static-analysis, dynamic-analysis, dependency-vulnerabilities, dependabot-alerts, github-advanced-security, secret-scanning, az400-security-gate-lab, security scenarios | ✅ explained + practised |
| Compliance gates | compliance-gate, security scenarios | ✅ explained + practised |
| Telemetry / Application Insights / synthetic tests / alerting / flow metrics | telemetry, application-insights, synthetic-testing, alerting, devops-flow-metrics, az400-observability-feedback-lab, instrumentation scenarios | ✅ explained + practised |
Current completion evidence
- Labs: every one of the 77 module notes contains a procedural Learn → Do → Verify → Break → Fix → Clean up exercise; the dedicated lab MOC adds cross-module challenges.
- Questions: 250 objective-weighted scenarios: 100 AZ-104 and 150 AZ-400. AZ-400 build/release has 82 questions, reflecting its 50–55% blueprint weight.
- Notes: the former explicit gaps—storage policy/identity/recovery, current compute emphasis, networking diagnosis, backup reporting, and AZ-400 2026-specific DevOps concepts—have dedicated notes and route links.
This is course-completion evidence, not an individual learner’s readiness result. The learner still has to complete the labs and meet the readiness gates.
Ready for cross-cutting build-outs
- Update this matrix as the vault grows (single source of truth for coverage).
- Labs: one procedural “Learn → Do → Verify → Break → Fix → Clean up” exercise per module. Start at Hands-on labs.
- Questions: the 250-question target is met. Maintain it by reviewing questions whenever either official study guide changes, and add questions when new objectives are introduced.