[Andreas Schwarz (ASchwarz1984)]

Summary

• Update Challenge 5 with the migrated demo screenshot, remove the artificial Azure Load Balancer exercise and hardcoded backend-IP assumptions, and finish with direct validation of both migrated VMs. Align the finish and Challenge 8 wording with that flow.
• Remove the obsolete Security Copilot setup task from Challenge 6 while retaining the Defender for Cloud work.
• Modernize Challenge 7 around portal-created Azure Monitor workspace and DCR onboarding, distinguish OpenTelemetry metrics from classic logs, and add Apache process and IIS service-event alert incidents. Use the current Infrastructure monitoring screenshot and explicitly require one pre-created user-assigned identity with Monitoring Reader for query-based and recommended alerts, separate from the VM system-assigned identity used by Azure Monitor Agent. Expand the Observability Agent workflow through investigation, issue creation, human remediation, recovery, post-incident review, and a clear controlled-autonomy boundary.
• Move Windows/IIS versus Ubuntu/Apache path selection into Challenge 8 and allow learners to complete either or both paths. Add explicit subscription and actual destination-resource-group safeguards, remove the actionless discovery-record task, and correct App Service replatforming for current Node LTS runtime discovery.
• Make Path B use stable, reusable App Service resources and independently rerunnable Azure Bastion-safe blocks that return failures to the SSH prompt. Correct the static Node/PM2 ZIP deployment, package validation, bounded readiness checks, Apache restoration, and cleanup behavior. Runtime discovery now accepts current NODE|<major>-lts output and normalizes the selected value only for az webapp create.

Validation

• Verified exact-case Markdown links and image references, PowerShell and Bash fence syntax, and the relevant KQL, PromQL, Bicep, workflow, and current Azure CLI semantics.
• Exercised deterministic Path B fixtures for runtime formats, stable resource reuse, ZIP/deploy arguments, bounded HTTP validation, safe shell failure, Apache restoration, and idempotent cleanup.
• The corrected Linux runtime-discovery/resource-creation step was confirmed with the current NODE|24-lts and NODE|22-lts output. This does not claim a fresh end-to-end rerun of every Windows and Linux lab task.

Scope

All changes remain under 03-Azure/01-03-Infrastructure/06_Migration_Secure_AI_Ready.