Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 121:

  You create an Azure subscription named Subscription1 and an associated Azure Active Directory (Azure AD) tenant named Tenant1. Tenant1 contains the users in the following table.

  

  You need to add an Azure AD Privileged Identity Management application to Tenant1.

  Which account can you use?

  A. [email protected]
  B. [email protected]
  C. [email protected]
  D. [email protected]
  B. [email protected]

  ---

  Explanation

  (REWRITTEN - Single Answer, Best-Practice Aligned)

  ---------------------------------------------------------------------------------------------------------------------------------

  [email protected]

  ---------------------------------------------------------------------------------------------------------------------------------

  Enabling and administering Microsoft Entra PIM for tenant roles requires an identity with sufficient Microsoft Entra directory permissions (for example, Global Administrator or Privileged Role Administrator).

  This rewritten item explicitly requires a dedicated internal administrator account (member user) as a best practice, which eliminates the external account as a valid choice. [email protected] is the only internal account that meets that requirement and has the appropriate tenant-level administrative role.

  Why the other options are not correct:

  - [email protected]:

  Conditional Access Administrator does not have the required tenant-wide permissions to enable/administer PIM for directory roles.

  - [email protected]:

  Security Administrator is not the correct role for onboarding/enabling PIM for tenant roles.

  - [email protected]:

  This is an external Microsoft account and does not meet the "dedicated internal administrator account" requirement stated in the question.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Privileged Role Administrator permissions (manages all aspects of Privileged Identity Management) https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator Date accessed: 2026-01-22

  (2) Microsoft Learn - Privileged Identity Management (PIM) overview / getting started https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-getting-started Date accessed: 2026-01-22

  (3) Microsoft Learn - Best practices for Microsoft Entra roles (least privilege / admin hygiene) https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices Date accessed: 2026-01-22

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For tenant-governance features like PIM, the deciding factor is the Microsoft Entra directory role (Global Admin / Privileged Role Admin), not the Azure subscription RBAC role (Owner/Contributor).

  - If the stem includes "best practice" or "dedicated internal admin," exclude external/consumer identities unless explicitly required.

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Selecting the proper Microsoft Entra tenant administrator account to enable PIM

  - Best-practice emphasis: dedicated internal admin identity and least privilege

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 1.0 Manage Azure identities and governance (20?5%) | 1.2 Manage access to Azure resources | 1.2.1 Manage built-in Azure roles

• Question 122:

  HOTSPOT

  You have an Azure Storage account named storage1 that contains a blob container. The blob container has a default access tier of Hot. Storage1 contains a container named conainer1.

  You create lifecycle management rules in storage1 as shown in the following table.

  

  You perform the actions shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  • On October 10, you can read Dep1File1.docx: No
  • On October 10, you can read File2.docx: Yes
  • On October 10, you can read File3.docx: Yes

  Why this is correct:

  • The lifecycle rules are evaluated based on days since last modification.
  • Dep1File1.docx matches the “Dep1” filter rule that moves blobs to the Archive tier after 2 days without modification; Archive is offline, so the blob is not readable without rehydration.
  • File2.docx and File3.docx (which do not match the Dep1 archive-after-2-days rule) follow the broader rule that moves blobs to Cool after 3 days; Cool remains readable.

  Exam Tip:
  
  If the tier is Archive, treat “Can I read it right now?” as No unless the question explicitly mentions rehydration.

• Question 123:

  You have an Azure subscription named Subscription1.

  You deploy a Linux virtual machine named VM1 to Subscription1.

  You need to monitor the metrics and the logs of VM1.

  What should you use?

  A. Linux Diagnostic Extension (LAD) 3.0
  B. Azure Analysis Services
  C. the AzurePerformanceDiagnostics extension
  D. Azure HDInsight
  A. Linux Diagnostic Extension (LAD) 3.0

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Linux Diagnostic Extension (LAD) 3.0

  ----------------------------------------------------------------------------------------------------

  LAD (Linux Diagnostics extension) is the Azure VM extension designed to collect guest OS monitoring data from Linux VMs (for example, syslog events and performance counters). That directly aligns with the requirement to monitor both

  *metrics* and *logs* for a Linux VM.

  Why the other selections are not correct:

  - Azure Analysis Services: A PaaS analytics service (semantic models); not a VM monitoring/log collection agent.

  - AzurePerformanceDiagnostics extension: Primarily a troubleshooting/performance diagnostics workflow, not the standard VM telemetry pipeline for ongoing metrics + log collection.

  - Azure HDInsight: A managed big-data cluster service; unrelated to collecting a single VM's guest metrics/logs.

  (Official support: Microsoft describes Azure Diagnostics extension as an Azure Monitor agent that collects monitoring data from the guest OS, and for Linux (LAD) it collects syslog, performance counters, and log files.)

  ----------------------------------------------------------------------------------------------------

  References:

  1. Azure Diagnostics extension overview - Azure Monitor | Microsoft Learn https://learn.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview Date Modified: 2025-11-21 Date Access: 01/24/2026 Excerpt (<=25 words): "collects monitoring data from the guest operating system..." and under Linux (LAD): "Syslog... Performance counters... Log files..."

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - On AZ-104, "VM monitoring (metrics + logs)" commonly maps to Azure Monitor agents/extensions (historically LAD/WAD; increasingly Azure Monitor Agent).

  - Know the distinction: *VM extensions/agents collect guest telemetry*; analytics services (Analysis Services/HDInsight) *consume* data but don't collect VM guest logs/metrics.

  Summary:

  This item tests identifying the correct Azure VM agent/extension used to collect Linux guest OS metrics and logs for monitoring.

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.2 Configure log settings in Azure Monitor |__ 5.1.5 Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights

• Question 124:

  You create the following resources in an Azure subscription:

  1. An Azure Container Registry instance named Registry1.

  2. An Azure Kubernetes Service (AKS) cluster named Cluster1.

  You create a container image named App1 on your administrative workstation.

  You need to deploy App1 to Cluster1.

  What should you do first?

  A. Create a host pool on Cluster1.
  B. Run the az acr build command.
  C. Run the docker build command.
  D. Run the docker push command.
  D. Run the docker push command.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Run the docker push command.

  --------------------------------------------------------------------------------

  You already "create a container image named App1" on your administrative workstation. Before AKS can deploy the workload, the image must be available in a registry accessible to the cluster-here, **Azure Container Registry (Registry1)**.

  The first action, given the image already exists locally, is to **push the image to ACR** using `docker push` (after tagging and authenticating as needed). (1)(2)

  Why other selections are incorrect:

  - Create a host pool on Cluster1.: Host pools are an Azure Virtual Desktop concept, not AKS/ACR deployment. (3)

  - Run the az acr build command.: `az acr build` is used to build (and typically push) an image in ACR from source/Dockerfile. The stem says the image is already created locally, so pushing is the next step. (2)

  - Run the docker build command.: The image is already created per the stem; rebuilding is not the first step. (1)

  --------------------------------------------------------------------------------

  References:

  1. Push and pull an image using the Docker CLI with Azure Container Registry https://learn.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli Date Modified: 08/28/2025 Date Accessed: 01/25/2026

  2. Tutorial - Quick Docker image build with ACR Tasks (az acr build context) https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-quick-task Date Modified: 05/03/2025 Date Accessed: 01/25/2026

  3. What is Azure Virtual Desktop host pool (context for "host pool") https://learn.microsoft.com/en-us/azure/virtual-desktop/host-pool-overview Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For AKS deployments, think in this order: build image --> push to registry --> reference image in a manifest (Deployment) --> apply to cluster.

  - `az acr build` is an alternative to local `docker build` when you want cloud build + push. If the image is already local, "push" is usually the differentiator.

  --------------------------------------------------------------------------------

  Summary:

  This tests container delivery flow to AKS: since App1 is already built, the first required step is to push it to ACR so the cluster can pull it.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) 3.3 Provision and manage containers in the Azure portal 3.3.1 Create and manage an Azure container registry

• Question 125:

  HOTSPOT

  You purchase a new Azure subscription named Subscription1.

  You create a virtual machine named VM1 in Subscription1. VM1 is not protected by Azure Backup.

  You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for 30 days.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - Location in which to store the backups: A Recovery Services vault

  - Object to use to configure the protection for VM1: A backup policy

  Why this is correct:

  - Azure VM Backup is configured in a **Recovery Services vault**.

  - The schedule (01:00) and retention (30 days) are defined in a **backup policy** applied to the VM.

  Why the other options are incorrect:

  - A storage account/blob container/file share are not how Azure VM Backup is configured.

  - A backup job is an execution result, not the configuration object; a recovery plan is for Azure Site Recovery, not Azure Backup scheduling.

  Exam Tip

  - If the question mentions "schedule + retention", think "Backup policy".

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and back up Azure resources  |__5.2 Back up and restore Azure resources |__|__5.2.1 Back up and restore Azure virtual machines

• Question 126:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription with a storage account.

  You want to use the Azure Import/Export service to import files to the storage account.

  Solution: You create a dataset CSV file and a driveset CSV file.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  For Azure Import/Export, the documented workflow for preparing drives and defining the import job includes working with CSV files such as dataset.csv and driveset.csv (generated/used by the import/export tooling). Creating these CSV files aligns with the expected job-definition inputs for an Import/Export import job. Therefore, the solution meets the goal.

  References:

  1. Preparing hard drives for an import job (Azure Import/Export) - Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/azure/storage/common/storage-import-export-tool-preparing-hard-drives-import Date Modified: As shown on page (Microsoft Learn) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - Be prepared to map each data-movement service to its required artifacts (CSV vs. command-line copy vs. device shipment workflow).

  Summary:

  - Azure Import/Export uses CSV artifacts (dataset/driveset) in the documented job preparation workflow.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 127:

  You have an Azure subscription that contains the identifies shown in the following table.

  

  User1, Principle, and Group1 are assigned the Monitoring Reader role.

  An action an alert rule named Alert1 that uses AG1.

  You need to identify who will receive an email notification when Alert1 is triggered.

  Who should you identity?

  A. User1, User2, Principle, and Principle2
  B. User1 and Principle only
  C. User1 only
  D. User1 and User2 only
  D. User1 and User2 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  User1 and User2 only

  --------------------------------------------------------------------------------

  In Azure Monitor, email notifications are sent based on the receivers configured in the Action Group. When the "role-based" (Azure Resource Manager role) email notification pattern is implied, the recipients are the user accounts who effectively hold the referenced role assignment (including via group membership). Managed identities do not receive email notifications as users do.

  Given:

  - User1 is directly assigned Monitoring Reader.

  - Group1 is assigned Monitoring Reader, and User2 is a member of Group1.

  - Principal1/Principal2 are managed identities; they are not email recipients in this notification context.

  Therefore, the users to identify as recipients are User1 and User2.

  Why other selections are not correct:

  - Any option including managed identities: managed identities are not email recipients for action group email notifications.

  - User1 only: ignores User2's effective role assignment via Group1.

  -------------------------------------------------------------------------------- References:

  1. Azure Monitor action groups (notification receivers) https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Separate "who has RBAC" from "who receives notifications," but recognize that some action group receiver types can target role assignments.

  - Group assignments can expand recipients to group members (users).

  -------------------------------------------------------------------------------- Summary:

  User1 (direct assignment) and User2 (via Group1) are the relevant email recipients; managed identities are not.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 128:

  HOTSPOT

  You have an Azure subscription that contains the resource groups shown in the following table.

  

  You create the following Azure Resource Manager (ARM) template named deploy.json.

  

  You deploy the template by running the following cmdlet.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Scenario (condensed):

  - Existing resource groups: RG1 (East US), RG2 (West US)

  - Template deploy.json creates Microsoft.Resources/resourceGroups with:

  - location: "eastus"

  - name: "[concat('RG', copyIndex())]"

  - copy count: 4

  - Deployment command:

  New-AzSubscriptionDeployment -Location westus -TemplateFile deploy.json

  Prompt:

  For each statement, select Yes if true; otherwise select No.

  Answer:

  - The template creates a resource group named RG0 in the East US Azure region. -> Yes

  - The template creates four new resource groups. -> No

  - The template creates a resource group named RG3 in the West US Azure region. -> No

  Why:

  - copyIndex() starting at 0 with count 4 yields RG0, RG1, RG2, RG3.

  - All resource groups in the template are set to location "eastus", so RG3 is NOT West US.

  - RG1 and RG2 already exist, so it is not “four new” resource groups.

  Excerpt(s) supporting subscription-scope creation and iteration (Microsoft Learn):

  - “You can … create resource groups within the subscription …” URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription Last updated on: 2025-08-01 Accessed by me on: 2026-01-29

  - Example shows subscription deployments can use:

  “type”: “Microsoft.Resources/resourceGroups” URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription Last updated on: 2025-08-01 Accessed by me on: 2026-01-29

  - “copy … count …” / resource iteration pattern (supports the RG0–RG3 outcome) URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-resources Last updated on: 2025-08-05 Accessed by me on: 2026-01-29

  References (APA; full URL; includes last-updated + accessed):

  - Microsoft. (2025, August 1). Deploy resources to subscription. Microsoft Learn. Retrieved January 29, 2026, from https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription (Last updated on 2025-08- 01)

  - Microsoft. (2025, August 5). Resource iteration in ARM templates. Microsoft Learn. Retrieved January 29, 2026, from https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-resources (Last updated on 2025-08-05)

  AZ-104 Exam Objective Hierarchy (from your uploaded objectives):

  1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.4 Manage resource groups

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Automate deployment of resources by using ARM templates and Bicep files |__|__3.1.1 Interpret an Azure Resource Manager template or a Bicep file |__|__3.1.4 Deploy resources by using Azure Resource Manager templates or Bicep files

• Question 129:

  You have an Azure Active Directory (Azure AD) tenant.

  All administrators must enter a verification code to access the Azure portal.

  You need to ensure that the administrators can access the Azure portal only from your on- premises network.

  What should you configure?

  A. an Azure AD Identity Protection user risk policy.
  B. the multi-factor authentication service settings.
  C. the default for all the roles in Azure AD Privileged Identity Management
  D. an Azure AD Identity Protection sign-in risk policy
  B. the multi-factor authentication service settings.

  ---

  Explanation

  --------------------------------------------------------------------------------

  the multi-factor authentication service settings.

  --------------------------------------------------------------------------------

  You must accomplish two outcomes:

  1) Require a verification code for administrators when they sign in (MFA).

  2) Restrict where administrators can sign in from (on-premises IP ranges).

  The Microsoft Entra multifactor authentication (MFA) service settings are where you configure "trusted IPs" (and related MFA settings). Trusted IP configuration is the only option in the provided choices that is specifically tied to controlling MFA behavior based on source IP ranges (commonly used alongside location-based access patterns). (1)(2)

  Why the other options are not correct:

  - an Azure AD Identity Protection user risk policy: User risk policies respond to the risk level of a user (compromised credentials indicators), not to enforcing "on-premises-only" access. (3)

  - the default for all the roles in Azure AD Privileged Identity Management: PIM manages role activation/assignment/eligibility and can require MFA for activation, but it does not, by itself, restrict portal sign-in to only on-premises networks.

  (General product behavior)

  - an Azure AD Identity Protection sign-in risk policy: Sign-in risk policies respond to sign-in risk signals; they are not the feature used to scope access strictly to on-premises IP ranges. (3)

  References:

  1. Configure Microsoft Entra multifactor authentication settings https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings Date Modified: 12/18/2025 Date Accessed: 01/25/2026 2. Conditional Access Policy: Using Network Signals (includes MFA Trusted IPs behavior) https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network Date Modified: 09/22/2025 Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - AZ-104: Be clear on the distinction between "risk-based" controls (Identity Protection) versus "location/network-based" access patterns.

  - In questions with limited answer options, choose the control that most directly matches the signal/condition mentioned (here: IP/network).

  Summary:

  This question covered enforcing MFA requirements and aligning authentication behavior with on-premises network IP ranges.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 130:

  DRAG DROP

  You have an Azure Linux virtual machine that is protected by Azure Backup.

  One week ago, two files were deleted from the virtual machine.

  You need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly as possible.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  1. From the Azure portal, click File Recovery from the vault 2. Select a restore point that contains the deleted files 3. Download and run the script to mount a drive on the local computer 4. Copy the files by using File Explorer

  Explanation:

  You need to restore a small set of deleted files as quickly as possible. Azure Backup’s VM “File Recovery” workflow is designed for item-level recovery from a VM recovery point without restoring the entire VM.

  Why the correct steps are correct (and why order matters):

  1) From the Azure portal, click File Recovery from the vault

  - This initiates the file-level recovery workflow for Azure VM backups (as opposed to full VM restore).

  2) Select a restore point that contains the deleted files

  - The restore point determines the snapshot/time-state you will mount to browse for the missing files.

  3) Download and run the script to mount a drive on the local computer

  - Azure Backup generates a script that mounts the selected recovery point as a locally accessible drive so you can browse the backed-up file system.

  4) Copy the files by using File Explorer

  - Once the recovery point is mounted, the fastest practical method for copying files back to the target (including an on-premises server via typical admin workflows) is to browse and copy the required files.

  Why the other options are not correct for this scenario:

  - From the Azure portal, click Restore VM from the vault

  - Restores an entire VM (or creates a new one), which is slower and unnecessary when you only need a few files.

  - Mount a VHD

  - Not the standard VM “File Recovery” workflow in Azure Backup for this scenario; the designed path is to generate/run the script that mounts the recovery point.

  - Copy the files by using AZCopy

  - AZCopy is for moving data to/from Azure Storage services. This scenario is file-level recovery from a VM backup recovery point, typically accessed through the mounted recovery drive and copied via standard file operations.

  References:

  1. Microsoft Learn. (2025, September 18). Recover files from Azure virtual machine backup.

  https://learn.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm Modified: 09/18/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. (2025, September 9). Tutorial - Restore files to a VM with Azure Backup.

  https://learn.microsoft.com/en-us/azure/backup/tutorial-restore-files Modified: 09/09/2025. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - AZ-104 often tests whether you choose “file-level recovery” vs “full VM restore.” If the requirement is “restore a few files quickly,” default to Azure Backup “File Recovery” rather than restoring the whole VM.

  - Watch for wording like “deleted files/folders” and “as quickly as possible” - it usually points to item-level recovery.

  Summary:

  This question covered Azure Backup file-level recovery for an Azure VM: selecting a restore point, generating a recovery script to mount the recovery point, and copying recovered files.

  AZ-104 Exam Objective Hierarchy:

  5 - Monitor and maintain Azure resources (10–15%) |__ 5.2 - Implement backup and recovery |__ 5.2.4 - Perform backup and restore operations by using Azure Backup

  Step 1-3 below:

  To restore files or folders from the recovery point, go to the virtual machine and perform the following steps:

  1. Sign in to the Azure portal and in the left pane, select Virtual machines. From the list of virtual machines, select the virtual machine to open that virtual machine's dashboard.

  2. In the virtual machine's menu, select Backup to open the Backup dashboard.

  3. In the Backup dashboard menu, select File Recovery.

  

  The File Recovery menu opens.

  

  4. From the Select recovery point drop-down menu, select the recovery point that holds the files you want. By default, the latest recovery point is already selected.

  5. Select Download Executable (for Windows Azure VMs) or Download Script (for Linux Azure VMs, a python script is generated) to download the software used to copy files from the recovery point.

  Running the script and identifying volumes:

  For Linux machines, a python script is generated. Download the script and copy it to the relevant/compatible Linux server.

  https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-automation#restore-files-from-an-azure-vm-backup