AZ-700 vs AZ-104 — take AZ-104 first if you are new to Azure or want maximum career flexibility. Take AZ-700 after AZ-104 if networking is your specialization and you want to go deep on Azure networking design and implementation. AZ-104 is not a formal prerequisite for AZ-700 but practically get the AZ-104 first — AZ-700 assumes you can navigate the Azure Portal, understand resource groups, and have basic networking concepts down solid. Without AZ-104 knowledge, AZ-700 preparation takes significantly longer.
In 2026, AZ-104 remains the strongest choice for breadth and employability while AZ-700 is the specialist credential for network engineers who want genuine differentiation.
AZ-700 vs AZ-104: Key Differences at a Glance
| Factor | AZ-104 | AZ-700 |
| Official name | Microsoft Azure Administrator | Microsoft Azure Network Engineer Associate |
| Level | Associate | Associate |
| Exam cost | $165 USD | $165 USD |
| Exam duration | 120 minutes | 120 minutes |
| Passing score | 700 out of 1000 | 700 out of 1000 |
| Expiration | 1 year — free annual renewal | 1 year — free annual renewal |
| Formal prerequisite | None | None formally — AZ-104 strongly recommended |
| Scope | Broad — 5 domains across all Azure operations | Narrow — 5 domains exclusively on Azure networking |
| Networking depth | Foundational — VNets, NSGs, basic VPN | Deep — ExpressRoute, Virtual WAN, BGP, Private Link, Azure Firewall |
| Live lab simulations | Yes — configure real Azure Portal | Yes — VNet configurations and connectivity labs |
| Coding required | No | No |
| Study time | 6 to 10 weeks with IT experience | 8 to 12 weeks — requires strong networking AND Azure background |
| Average US salary | $88,000 to $161,000 | $100,000 to $145,000 |
| Job posting volume | Highest of any Azure associate — 78,000+ | Specialist — fewer but highly targeted |
| Leads to | AZ-305, SC-500, AZ-400, AZ-700 | AZ-305 with AZ-104, hybrid networking architect roles |
| Best for | Cloud administrators, infrastructure engineers, career starters | Network engineers, cloud network architects, hybrid connectivity specialists |
What Is the Main Difference Between AZ-700 and AZ-104?
AZ-104 is broad and AZ-700 is deep. AZ-104 covers everything an Azure administrator does on a typical day — identity, storage, compute, networking, and monitoring across the entire platform. AZ-700 covers only one of those areas — networking — but at a level of depth that AZ-104 never approaches.
Think of it this way. AZ-104 gives you the keys to the entire Azure house. You can open every door and know what is inside. AZ-700 gives you a complete blueprint for the plumbing and electrical systems that run through the walls. Both kinds of knowledge are essential in enterprise Azure environments. Most organizations need professionals with AZ-104 breadth. Large enterprises with complex hybrid connectivity requirements additionally need professionals with AZ-700 depth.
The ideal combo for senior Azure roles is AZ-104 then AZ-700 then AZ-305. That covers administration, networking, and architecture — the three pillars of senior Azure infrastructure competency.
What Does AZ-104 Cover?
AZ-104 is the Microsoft Azure Administrator Associate certification. It validates your ability to implement, manage, and monitor Azure environments across all five operational domains. Networking is one of five domains in AZ-104 — essential but not the primary focus.
AZ-104 Exam Domains
| Domain | Weight | What You Do |
| Manage Azure identities and governance | 15-20% | Microsoft Entra ID, RBAC, Azure Policy, subscriptions, resource locks |
| Implement and manage storage | 15-20% | Storage accounts, blob storage, Azure Files, lifecycle policies, redundancy |
| Deploy and manage Azure compute resources | 20-25% | VMs, VM scale sets, App Service, Container Instances, AKS basics |
| Implement and manage virtual networking | 15-20% | VNets, subnets, NSGs, VPN Gateway basics, Azure DNS, Load Balancer, Application Gateway |
| Monitor and maintain Azure resources | 10-15% | Azure Monitor, Log Analytics, Azure Backup, Site Recovery |
What AZ-104 covers in networking: The virtual networking domain at 15 to 20 percent covers VNet creation and subnetting, Network Security Groups and their rule evaluation, basic VPN Gateway configuration, Azure DNS, Load Balancer, Application Gateway, and VNet peering. This is sufficient for general Azure administration but leaves many enterprise networking topics untouched.
What AZ-104 does not cover: ExpressRoute, Virtual WAN, BGP routing, Private Link and private endpoints at depth, Azure Firewall advanced policies, Azure Route Server, hub-and-spoke topology design, and SD-WAN integration. These topics belong to AZ-700.
Who AZ-104 is for: IT administrators, systems engineers, cloud operators, and infrastructure professionals who manage Azure environments across all operational dimensions — not just networking.
What Does AZ-700 Cover?
AZ-700 is the Microsoft Azure Network Engineer Associate certification. It validates your ability to plan, implement, and manage complex Azure networking solutions including hybrid connectivity, application delivery, and private access patterns. Everything AZ-104 covers in networking is foundational knowledge that AZ-700 assumes before going significantly deeper.
AZ-700 Exam Domains
| Domain | Weight | What You Design and Implement |
| Design and implement core networking infrastructure | 20-25% | VNets, subnets, IP addressing, DNS, name resolution, VNet peering and service chaining, Azure Virtual Network Manager |
| Design, implement, and manage connectivity services | 20-25% | VPN Gateways (site-to-site, point-to-site), ExpressRoute circuits and gateways, Virtual WAN, Azure Route Server, BGP configuration |
| Design and implement application delivery services | 20-25% | Azure Load Balancer, Application Gateway, Azure Front Door, Azure Traffic Manager, WAF policies, CDN integration |
| Design and implement private access to Azure services | 5-10% | Private endpoints, Private Link services, service endpoints, DNS integration for private access |
| Secure network connectivity to Azure resources | 15-20% | Azure Firewall and Firewall Manager, Network Security Groups, Application Security Groups, DDoS Protection, Just-in-Time VM access |
What makes AZ-700 genuinely difficult: AZ-700 scenario questions present multi-constraint connectivity problems. A single question might require you to design ExpressRoute failover to VPN Gateway with specific BGP path preferences, integrate Private Link for a specific service, and ensure Azure Firewall policies are applied correctly — all simultaneously. This requires deep operational experience with enterprise networking, not just conceptual awareness.
The lab simulation requirement: AZ-700 includes performance-based questions where you configure real Azure networking resources. Familiarity with the Azure Portal and knowing exactly where specific settings live is critical to completing lab tasks efficiently within the time limit. Candidates who have not built real Azure networking configurations consistently struggle with these questions.
AZ-700 vs AZ-104: Difficulty Comparison
| Factor | AZ-104 | AZ-700 |
| Breadth | Very broad — 5 different domain areas | Narrow but extremely deep — networking only |
| Hardest area | Virtual networking and live lab time management | ExpressRoute, BGP configuration, and multi-constraint connectivity design |
| Prerequisites in practice | Basic IT and Azure knowledge | AZ-104 level knowledge plus deep networking background |
| Study time | 6 to 10 weeks with IT experience | 8 to 12 weeks after AZ-104 |
| Lab simulation difficulty | Moderate — standard Azure administration tasks | High — complex networking configurations under time pressure |
| Most common failure reason | Insufficient hands-on networking practice | Insufficient ExpressRoute and BGP hands-on experience |
| Required background | General IT and systems administration | Enterprise networking AND Azure experience combined |
| Pass rate | 60 to 70 percent prepared candidates | Lower — narrower candidate pool with stronger average background |
AZ-700 is harder than AZ-104 for most candidates. The combination of deep enterprise networking knowledge and Azure-specific implementation knowledge that AZ-700 requires is genuinely rare. Candidates who have done both traditional enterprise networking and Azure administration are well-positioned. Candidates from only one background typically find significant knowledge gaps.
AZ-700 vs AZ-104: Salary Comparison
AZ-104 Salary by Role
| Role | Average US Salary |
| Azure Administrator | $95,000 to $130,000 |
| Cloud Engineer | $100,000 to $135,000 |
| Infrastructure Engineer | $95,000 to $125,000 |
| Senior Cloud Engineer | $145,000 to $218,000 |
AZ-700 Salary by Role
| Role | Average US Salary |
| Azure Network Engineer | $100,000 to $140,000 |
| Cloud Network Architect | $120,000 to $160,000 |
| Hybrid Connectivity Specialist | $110,000 to $150,000 |
| Senior Network Engineer (Azure) | $130,000 to $165,000 |
| Network Security Engineer | $115,000 to $155,000 |
AZ-700 commands a premium over AZ-104 in specialized networking roles. This reflects the scarcity of professionals who combine deep enterprise networking knowledge with Azure implementation skills. In large enterprises and managed service providers running complex hybrid connectivity architectures, AZ-700 certified engineers command rates 15 to 20 percent above AZ-104 administrators at comparable experience levels.
However AZ-104 opens significantly more total positions. AZ-700 roles are concentrated in large enterprises and organizations with complex hybrid networking requirements. AZ-104 roles exist in organizations of every size and across every industry. For maximum job market access, AZ-104 is the stronger foundation. For maximum salary premium in networking specialization, AZ-700 delivers genuine differentiation.
Is AZ-104 Required Before AZ-700?
No — AZ-104 is not a formal prerequisite for AZ-700. Microsoft lists no mandatory prerequisites for AZ-700. You can register and take AZ-700 without ever having taken AZ-104.
However practically get the AZ-104 first. AZ-700 assumes you can navigate the Azure Portal, understand resource groups, know what a subscription is, and have foundational networking concepts solid. The AZ-104 covers all of this. Without AZ-104 knowledge, AZ-700 preparation takes significantly longer because you are learning two things simultaneously — general Azure operations and advanced Azure networking. With AZ-104 knowledge, you can focus your AZ-700 study time entirely on the advanced networking content.
The community consensus from candidates who have taken both certifications is clear: AZ-104 first, then AZ-700. This sequence saves 4 to 6 weeks of total preparation time compared to attempting AZ-700 without AZ-104 background.
Who Should Take AZ-104 First?
Take AZ-104 before AZ-700 if:
You are new to Azure and want to build a broad operational foundation. AZ-104 gives you the Azure vocabulary, platform familiarity, and operational knowledge that makes every subsequent Azure certification more efficient. AZ-700 without AZ-104 means learning portal navigation, resource organization, and Azure concepts alongside advanced networking topics simultaneously.
Your target role is cloud administrator, infrastructure engineer, or cloud support. These positions require the breadth that AZ-104 validates. AZ-700 alone does not qualify you for general Azure administration roles and is too specialized as a standalone credential for most entry-level positions.
You want to pursue AZ-305 Azure Solutions Architect Expert. AZ-305 requires an active AZ-104 as its mandatory prerequisite. If architecture is your ultimate career goal, AZ-104 is non-negotiable. For the complete breakdown of that path, our AZ-104 vs AZ-305 guide covers when to make the jump.
You are building toward the ideal combination of AZ-104, AZ-700, and AZ-305. The AZ-104 to AZ-700 to AZ-305 sequence covers administration, networking, and architecture — the three pillars of senior Azure infrastructure competency. This combination is recognized as one of the strongest Azure certification profiles for senior cloud roles.
Who Should Take AZ-700?
Take AZ-700 if:
You are a network engineer or network architect transitioning to Azure. AZ-700 validates the skills traditional network engineers bring to cloud networking — routing, connectivity, firewall policy, and hybrid architecture — applied to the Azure platform. For network engineers who already understand BGP, site-to-site VPN, and enterprise firewall policies, AZ-700 is the most direct path to formalizing Azure-specific networking expertise.
You already hold AZ-104 and want to specialize in networking. AZ-700 is the natural specialization certification for AZ-104 holders whose daily work is dominated by networking responsibilities — managing ExpressRoute connections, designing hub-and-spoke topologies, configuring Azure Firewall policies, or implementing Private Link for enterprise service access.
Your organization runs complex hybrid networking with ExpressRoute or Virtual WAN. AZ-700 is where organizations with complex hybrid connectivity, multiple on-premises sites connected to Azure, and large-scale Virtual WAN deployments find the most value. If these describe your environment, AZ-700 validates the specific skills your work requires.
You want genuine differentiation in the Azure networking market. AZ-700 is a specialist credential. The pool of AZ-700 certified professionals is significantly smaller than AZ-104 holders, which creates meaningful differentiation in networking-specific hiring. Organizations specifically looking for Azure network engineers filter for AZ-700 in a way they do not for AZ-104.
The AZ-104, AZ-700, AZ-305 Combination: The Senior Azure Infrastructure Path
For professionals building toward senior Azure infrastructure roles — cloud architect, principal engineer, infrastructure architect — the AZ-104 to AZ-700 to AZ-305 sequence is widely recognized as the strongest certification pathway.
| Stage | Certification | What It Validates | Time After Previous |
| 1 | AZ-104 | Broad Azure administration | 6 to 10 weeks from IT background |
| 2 | AZ-700 | Deep Azure networking design | 8 to 12 weeks after AZ-104 |
| 3 | AZ-305 | Azure solutions architecture | 8 to 12 weeks after AZ-104 (can parallel AZ-700) |
Note on sequencing: AZ-305 requires only AZ-104 as a prerequisite. AZ-700 is not required before AZ-305. Many professionals pursue AZ-700 and AZ-305 in parallel after AZ-104, or take AZ-305 first and add AZ-700 when networking depth becomes a career priority. Either sequence works. The combination of all three credentials signals a comprehensive senior Azure infrastructure competency that very few professionals hold.
For the complete Azure career path from AZ-900 through associate and expert level, our AZ-104 vs AZ-900 guide covers the foundational decision and our Is AZ-104 Worth It guide covers the complete salary and career analysis for the AZ-104 foundation. For the complete picture of every Microsoft certification change in 2026, our Microsoft certifications retiring in 2026 guide covers every retirement and replacement.
How to Prepare for AZ-104
Step 1: Build real Azure experience from day one. AZ-104 includes live lab simulations requiring genuine hands-on Azure skills. Create a free Azure account and build real environments — deploy VMs, create VNets, configure NSGs, implement RBAC. Reading without building consistently leads to failure on lab questions.
Step 2: Master virtual networking before the exam. The networking domain in AZ-104 is foundational for AZ-700 later. Invest extra time in VNet configuration, NSG rule evaluation, and Azure DNS even if these are not your primary day-to-day responsibilities.
Step 3: Use current practice materials. Our Microsoft exam preparation section covers current AZ-104 practice materials aligned to the 2026 exam blueprint.
How to Prepare for AZ-700
Step 1: Build solid enterprise networking knowledge before starting. AZ-700 assumes you understand BGP, routing protocols, site-to-site VPN fundamentals, and enterprise firewall policy design from traditional networking experience. If these concepts are unfamiliar, spend time on networking fundamentals before AZ-700 exam preparation.
Step 2: Get hands-on with ExpressRoute and Virtual WAN specifically. ExpressRoute configuration, Virtual WAN topology design, and BGP path selection appear throughout AZ-700 and are the areas where candidates with only Azure experience (not traditional networking) consistently struggle. Build lab scenarios using ExpressRoute Gateway configurations and Virtual WAN hubs.
Step 3: Practice Private Link and private endpoint scenarios. Private access to Azure services through Private Link and private endpoints is heavily tested in AZ-700 and involves complex DNS integration. Build hands-on scenarios connecting a private endpoint to a PaaS service and resolving DNS through private DNS zones.
Step 4: Study the Azure Well-Architected Framework networking pillar. Many AZ-700 scenario questions reward candidates who understand Microsoft’s recommended networking patterns from the Well-Architected Framework. Hub-and-spoke topology, defense in depth through layered network controls, and hybrid connectivity redundancy patterns all inform correct answers.
Step 5: Use John Savill’s free AZ-700 study cram on YouTube. Consistently rated the best free single preparation resource for AZ-700. It covers all five domains at the right depth and is updated for current exam content. Combine it with hands-on Packet Tracer or Azure lab practice.
Step 6: Use current practice materials. Our Microsoft exam preparation section covers current AZ-700 practice materials.
Decision Framework: AZ-700 vs AZ-104
| Your Situation | Take This |
| New to Azure with general IT background | AZ-104 first |
| Already hold AZ-104, networking is your specialty | AZ-700 |
| Target role is cloud administrator | AZ-104 |
| Target role is Azure network engineer | AZ-104 then AZ-700 |
| Want AZ-305 eventually | AZ-104 first — it is the mandatory prerequisite |
| Come from traditional network engineering background | AZ-104 then AZ-700 quickly |
| Work with ExpressRoute or Virtual WAN daily | AZ-700 after AZ-104 |
| Want maximum total job openings | AZ-104 — 78,000 plus postings |
| Want specialist differentiation in networking | AZ-700 |
| Work in large enterprise with hybrid connectivity | AZ-700 after AZ-104 |
| Work in small or mid-size organization | AZ-104 — AZ-700 is likely overkill |
| Building toward senior architecture roles | AZ-104, then AZ-700 and AZ-305 |
| Want to add security specialization | AZ-104 then SC-500, not AZ-700 |
Frequently Asked Questions: AZ-700 vs AZ-104
What is the difference between AZ-700 and AZ-104?
AZ-104 is a broad Azure administrator certification covering identity, storage, compute, networking, and monitoring across five operational domains. AZ-700 is a specialized Azure networking certification covering only networking — but at the deep enterprise level including ExpressRoute, Virtual WAN, BGP, Private Link, and Azure Firewall. AZ-104 is broad. AZ-700 is deep.
Do I need AZ-104 before AZ-700?
No — AZ-104 is not a formal prerequisite for AZ-700. However practically you should get AZ-104 first. AZ-700 assumes AZ-104 level Azure familiarity and without it preparation takes 4 to 6 weeks longer. Community consensus from candidates who hold both certifications is consistent: AZ-104 first then AZ-700.
Which is harder — AZ-700 or AZ-104?
AZ-700 is harder for most candidates. It requires deep enterprise networking knowledge combined with Azure implementation skills — a combination that is genuinely rare. AZ-104 is broader but more accessible to candidates with general IT backgrounds. AZ-700 has a smaller candidate pool with a higher average technical background, which makes the pass rate comparison complex but the content depth of AZ-700 is significantly greater.
Which pays more — AZ-700 or AZ-104?
AZ-700 pays more in specialized networking roles. Azure Network Engineers earn $100,000 to $140,000 and Cloud Network Architects earn $120,000 to $160,000. AZ-104 holders earn $88,000 to $130,000 in administrator roles but can reach $145,000 to $218,000 at the senior engineer level. AZ-700 commands a 15 to 20 percent premium in networking-specific positions.
How long does AZ-700 take to prepare for?
Most candidates with strong AZ-104 knowledge and enterprise networking experience need 8 to 10 weeks. Candidates with AZ-104 but limited traditional networking experience need 10 to 14 weeks. Candidates attempting AZ-700 without AZ-104 background need 14 to 20 weeks in most cases.
What comes after AZ-700?
The most common next step after AZ-700 is AZ-305 (Azure Solutions Architect Expert) for candidates pursuing architecture roles. Many AZ-700 holders also pursue SC-500 (Cloud and AI Security Engineer) to add network security depth alongside their networking specialization.
Does AZ-700 have lab simulations?
Yes. AZ-700 includes performance-based questions where you configure real Azure networking resources in the Azure Portal during the exam. Knowing where specific settings are in the portal and being able to complete configurations efficiently within the time limit is essential.
Is AZ-700 worth it in 2026?
Yes — for the right professional. AZ-700 is worth it for network engineers specializing in Azure, professionals working with ExpressRoute and Virtual WAN daily, and anyone building toward a senior Azure infrastructure profile combining AZ-104, AZ-700, and AZ-305. It is not worth it as a standalone first Azure certification or for professionals in small organizations where advanced hybrid networking is not required.
What is the difference between AZ-700 and AZ-305?
AZ-305 tests architectural design decisions across all Azure domains at the expert level. AZ-700 tests implementation-level networking skills at the associate level. AZ-305 is higher level and broader. AZ-700 is lower level and deeper in networking specifically. Both require AZ-104 as a foundational building block and are complementary rather than competing credentials.
Can I take AZ-700 without networking experience?
Technically yes but practically very difficult. AZ-700 assumes knowledge of BGP, routing protocols, enterprise VPN, and firewall policy design from traditional networking experience. Candidates without this background spend a significant portion of their AZ-700 preparation building foundational networking knowledge that the exam assumes they already have.
