Quartz 5

Lab: AZ-104 integrated administration challenge

Properties1
tagslab, az-104, integrated, administration, troubleshooting

3 min read

Lab: AZ-104 integrated administration challenge

Outcome

Build a small, controlled Azure workload and demonstrate that you can govern it, secure its network and storage access, observe it, and diagnose a deliberately introduced failure. This is a synthesis exercise; it does not replace each module’s focused lab.

Before you begin

Use a dedicated training subscription and a cost limit. Read every cleanup step before deployment. Some resources can incur charges; use small SKUs and remove them promptly. Do not use production data, identities, or secrets.

Scenario

Contoso needs a training web workload. The platform team requires a tagged resource group, least-privilege access for operators, private access from the workload subnet to a storage account, central monitoring, and recoverable data. The workload must not expose a public storage endpoint.

Do

  1. Create rg-azlearn-integrated with environment=training, owner=<your-alias>, and costcenter=learning tags. Add a budget/alert appropriate to the training subscription.
  2. Create a VNet with separate workload and private-endpoint subnets. Deploy a small supported compute workload in the workload subnet.
  3. Create a StorageV2 account with secure transfer required and public blob access disabled. Create a private endpoint and private DNS configuration so the workload resolves the storage service to a private address.
  4. Create a training operator group. Assign it Reader at the resource-group scope. Give only the required Storage data-plane role at the storage scope if the operator must read data.
  5. Send diagnostic/monitoring data to Log Analytics. Create a safe alert/action group for a chosen workload or availability signal.
  6. Configure an appropriate backup policy or data-protection setting for the resource type you chose. Record the recovery objective you are meeting.

Verify

Collect evidence for all of the following:

  1. Tags, resource hierarchy, and budget alert.
  2. Effective RBAC assignments, including the difference between Reader and a data-plane role.
  3. Private DNS resolution from the workload and successful private storage access.
  4. Storage public-network/public-blob settings.
  5. A monitor signal, alert rule, action group, and a query or dashboard view.
  6. Backup/protection configuration and a successful safe restore or recovery validation where supported.

Break and fix

  1. Unlink the private DNS zone in the training environment. Confirm the storage hostname resolves incorrectly or access fails; restore the link and verify private resolution.
  2. Test access as the Reader-only operator. Confirm that control-plane visibility does not automatically grant Blob data access. Add then remove the minimum required data-plane role to prove the distinction.
  3. Suppress the alert action temporarily. Confirm the condition can occur without notification, then restore the action group.

Clean up

Remove role assignments created only for the exercise, action groups, alerts, diagnostic settings, private endpoint, storage account, compute workload, VNet, and the resource group. Confirm that no billable training resource remains.

Reflection

Explain how Entra ID, Azure RBAC, private DNS, Private Endpoint, Storage network rules, Azure Monitor, and Azure Backup each solve a different part of the scenario. If two services appear to overlap, state the decision boundary.

Sources and re-audit

Re-audit when private networking, monitoring, backup workload support, or Azure RBAC behavior changes.

Azure foundations · rbac · private-endpoint · storage-network-rule · azure-monitor · azure-backup · All labs

Graph View

Backlinks