diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md
index 3a7407af8..9bd601e19 100644
--- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md
+++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md
@@ -62,7 +62,7 @@ In order to use the MicroHack time most effectively, the following tasks should
 
 1. Your own Azure subscription with Owner RBAC rights at the subscription level
 2. Contributor or Owner permissions on your subscription or resource group
-3. Optional: Access to Azure Arc Jumpstart ArcBox & LocalBox for hybrid challenges
+3. Access to Azure Arc Jumpstart LocalBox if completing Challenge 6, including the [guest-management and Defender readiness checks](./resources/demo-vm-creator/README.md#step-6-test-the-environment)
 4. [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli). **Hint:** Make sure to use the latest version available.
 5. Challenge 7: `kubectl`, `jq`, OpenSSL, the [Radius CLI](https://docs.radapp.io/getting-started/install/), and the Azure CLI `bastion` extension
 
@@ -92,17 +92,16 @@ Use the AZQR report for planning and preferred-region ordering, not as the deplo
 
 The main cost driver for this MicroHack is virtual machines:
 
-- **ArcBox for ITPro** cost is approximately 7 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 30-40 USD.
 - **LocalBox** cost is approximately 100-110 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 5-600 USD.
 - **Challenges 4, 5, and 7** share one pre-provisioned participant platform: a two-node AKS system pool, one Confidential VM AKS node, one standalone Confidential VM, one K3s VM, Azure Bastion Standard, and a NAT Gateway. Budget approximately 45-55 USD per participant per day, depending on region and data transfer. The platform starts during lab deployment so participants can focus on validation rather than waiting for capacity-sensitive resources.
 - Plan subscription quotas for at least 12 general-purpose vCPUs and 4 DCasv5- or DCasv6-family confidential vCPUs per participant. Keep the default maximum of two participants per subscription unless larger aggregate increases have been approved in advance.
 
-For a 50-participant event, the shared participant platforms cost approximately 2,250-2,750 USD per day while deployed, in addition to the optional ArcBox and LocalBox environments.
-There will also be smaller costs for services such as Key Vault, storage, and monitoring.
+For a 50-participant event, the shared participant platforms cost approximately 2,250-2,750 USD per day while deployed, in addition to the optional LocalBox environment.
+There will also be smaller costs for services such as Key Vault, storage, and monitoring. Budget separately for the approved Defender for Servers plan used in Challenge 6.
 An Azure Pricing Calculator estimate is available [here](https://azure.com/e/1a7aec76a3e049cba57cda6742025373).
 This estimate can be adjusted for fewer/more students, running the VMs shorter/longer and adding additional services if desired.
 
-If you plan to run this MicroHack in your own subscription on a limited budget, skip the optional Challenge 6 environments and remove the participant resource group immediately after finishing the event.
+If you plan to run this MicroHack in your own subscription on a limited budget, skip the optional Challenge 6 environment and remove the participant resource group immediately after finishing the event.
 
 ## Contributors
 
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md
index f2b461819..c9aaea774 100644
--- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md
+++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md
@@ -4,7 +4,7 @@
 
 ## Goal
 
-The goal of this challenge is to operate a sovereign hybrid cloud environment by combining Microsoft Sovereign Public Cloud and Sovereign Private Cloud components. You will work with Azure Local and Arc-enabled Servers (simulated via Arc Jumpstart ArcBox and LocalBox) as a sovereign on-premises cloud environment and use Azure Arc to bridge on-premises resources with Azure for unified governance, security, and management.
+The goal of this challenge is to operate a sovereign hybrid cloud environment by combining Microsoft Sovereign Public Cloud and Sovereign Private Cloud components. You will work with Azure Local, simulated via Azure Arc Jumpstart LocalBox, and provision your own VM. You will use Azure Arc to manage that VM through Azure, review its security posture with Microsoft Defender for Cloud, and assess its OS updates with Azure Update Manager.
 
 ## Scenario
 
@@ -12,33 +12,28 @@ Your organization must run workloads in a sovereign cloud while still leveraging
 
 ## Actions
 
-* Explore the ArcBox and LocalBox hybrid infrastructure in the Azure Portal
-* Navigate Arc-enabled servers and understand their Azure resource representation
-* Assign Azure Policy with Machine Configuration to audit/enforce OS settings on Arc-enabled Linux servers
-* Deploy a VM on Azure Local using Azure Arc VM management
-* Enable and review Microsoft Defender for Cloud security posture for Arc-enabled resources
-* Explore Azure Update Manager for hybrid patching across Arc-connected machines
+* Explore the LocalBox hybrid infrastructure in the Azure Portal
+* Deploy your own VM on Azure Local using Azure Arc VM management and verify that guest management is connected
+* Verify Microsoft Defender for Cloud coverage and review security recommendations for the VM you provisioned
+* Use Azure Update Manager to assess OS updates on the VM you provisioned
 
 ## Success criteria
 
-* You can navigate and understand the ArcBox/LocalBox hybrid environment in the Azure Portal
-* You have successfully assigned an Azure Policy (e.g., SSH Posture Control) to Arc-enabled servers
-* You can verify the compliance status of Arc-enabled servers in the Azure Policy dashboard
-* You can verify the compliance status of Arc-enabled servers in the Azure Machine Configuration blade
-* You have deployed a VM on Azure Local via the Azure Portal
-* You have enabled Microsoft Defender for Cloud and reviewed security recommendations for hybrid resources
+* You can navigate and understand the LocalBox hybrid environment in the Azure Portal
+* You have deployed your own VM on Azure Local via the Azure Portal and verified that guest management is Enabled (Connected)
+* You have verified Defender for Servers coverage for your VM and reviewed its available recommendations, or identified that its assessment is still pending
+* You have completed an Azure Update Manager assessment for your VM and reviewed the results, including when no updates are pending
 * You understand how Azure Arc provides a unified control plane for sovereign hybrid scenarios
 
 ## Learning resources
 
-* [Azure Arc-enabled Servers overview](https://learn.microsoft.com/azure/azure-arc/servers/overview)
+* [Azure Arc-enabled Servers overview (background for guest management)](https://learn.microsoft.com/azure/azure-arc/servers/overview)
 * [Azure Local hybrid capabilities](https://learn.microsoft.com/azure/azure-local/hybrid-capabilities-with-azure-services-23h2)
-* [Azure Machine Configuration (Guest Configuration)](https://learn.microsoft.com/azure/governance/machine-configuration/overview)
-* [What is SSH Posture Control?](https://learn.microsoft.com/azure/osconfig/overview-ssh-posture-control-mc)
-* [Azure Policy built-in definitions for Arc-enabled servers](https://learn.microsoft.com/azure/azure-arc/servers/policy-reference)
+* [Create Azure Local VMs](https://learn.microsoft.com/azure/azure-local/manage/create-arc-virtual-machines)
+* [Enable guest management on Azure Local VMs](https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines#enable-guest-management)
 * [Microsoft Defender for Cloud with Arc-enabled servers](https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-machines)
+* [Azure Update Manager overview](https://learn.microsoft.com/azure/update-manager/overview)
 * [Azure Arc Jumpstart - LocalBox](https://jumpstart.azure.com/azure_jumpstart_localbox)
-* [Govern Azure Arc-enabled servers (Microsoft Learn Training)](https://learn.microsoft.com/training/modules/govern-azure-arc-enabled-servers/)
 
 ## Solution
 
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md
index 416493d69..cbe6983f0 100644
--- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md
+++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md
@@ -1,41 +1,17 @@
-# Deploy Azure Arc Jumpstart Lab Environments
+# Deploy Azure Arc Jumpstart LocalBox
 
-This folder contains scripts to deploy lab environments for the Sovereign Cloud MicroHack using Azure Arc Jumpstart.
+This folder contains the manual deployment entry point and preparation instructions for the Sovereign Cloud MicroHack's Azure Arc Jumpstart LocalBox environment.
 
 ## Overview
 
-For Challenge 6 (Operating a Sovereign Hybrid Cloud with Azure Arc & Azure Local), we leverage the official Azure Arc Jumpstart environments rather than creating custom templates. This ensures:
+For Challenge 6 (Operating a Sovereign Hybrid Cloud with Azure Arc & Azure Local), we use the official Azure Arc Jumpstart LocalBox environment. Participants provision their own Azure Local VMs and use those VMs for the Defender for Cloud and Azure Update Manager exercises. This provides:
 
 - **Maintained templates** - Arc Jumpstart is actively maintained by Microsoft
 - **Latest features** - Always uses the newest Azure Arc and Azure Local capabilities
 - **Validated configurations** - Tested and proven deployment patterns
 - **Comprehensive documentation** - Extensive guides available
 
-## Available Environments
-
-### 1. ArcBox for IT Pros
-A pre-packaged Azure Arc sandbox environment with nested VMs onboarded to Azure Arc.
-
-**Features:**
-- Multiple Arc-enabled servers (Windows and Linux)
-- Pre-configured Azure Arc extensions
-- Log Analytics workspace integration
-- Azure Policy integration
-
-**Requirements:**
-- 8 vCPUs
-- ~30 minutes deployment time
-
-**Deployment:**
-```powershell
-.\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox-shared" -Location "swedencentral"
-```
-
-**Cost**
-
-ArcBox for ITPro cost is approximately 7 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 30-40 USD.
-
-### 2. LocalBox
+## LocalBox
 Azure Local environment simulating an on-premises private cloud.
 
 **Features:**
@@ -57,9 +33,10 @@ Azure Local environment simulating an on-premises private cloud.
 
 LocalBox cost is approximately 100-110 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 5-600 USD.
 
+Budget separately for the approved Defender for Servers plan and review its scope and charges before enabling it on the shared subscription.
+
 ## Arc Jumpstart Resources
 
-- **ArcBox Documentation**: https://jumpstart.azure.com/azure_jumpstart_arcbox
 - **LocalBox Documentation**: https://jumpstart.azure.com/azure_jumpstart_localbox
 - **GitHub Repository**: https://github.com/microsoft/azure_arc
 
@@ -72,18 +49,14 @@ Before deploying, ensure you have:
 3. Azure CLI and Az PowerShell modules installed
 
 ### Step 2: Deploy Environment
-Choose the appropriate deployment script:
+Run the LocalBox deployment script:
 
 ```powershell
-# For Arc-enabled servers challenge
-.\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox-shared" -Location "swedencentral"
-
-# For Azure Local challenge
 .\deploy-localbox.ps1 -ResourceGroupName "rg-localbox-shared" -Location "swedencentral"
 ```
 
 ### Step 3: Wait for Deployment
-Deployments can take 2-6 hours depending on the environment. Monitor progress in:
+LocalBox provisioning can take 4-6 hours, with additional time for the VM image and preparation steps below. Monitor progress in:
 - Azure Portal > Resource Groups > Deployments
 
 #### Hackathons console deployment behavior
@@ -243,7 +216,7 @@ You should also see updated values in the Azure Portal:
 6. Select **Review + create** and wait for the deployment to finish
 
 Role assignments:
-1. In the Azure Portal, navigate to your resource group where LocalBox is deployed (e.g. rg-localbox)
+1. In the Azure Portal, navigate to your resource group where LocalBox is deployed (e.g. `rg-localbox-shared`)
 2. Select **Access control (IAM)** in the left menu
 3. Click **+ Add -> Add role assignment** to start the role assignment wizard
 ![Create role assignment](./img/add_rbac_01.jpg)
@@ -256,16 +229,31 @@ Role assignments:
 ![Create role assignment](./img/add_rbac_04.jpg)
 8. Repeat steps 1-7 to add a role assignment for the **Azure Stack HCI VM Contributor** role
 ![Create role assignment](./img/add_rbac_05.jpg)
-8. Repeat steps 1-7 to add a role assignment for the **Reader** role and **User Access Administrator** role for the resource group where **ArcBox** is deployed (e.g. rg-arcbox)
-- For the **User Access Administrator** role, select **Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)** on the **Conditions** tab:
-![Create role assignment](./img/add_rbac_06.jpg)
+
+Hosted lab automation grants participants access to shared LocalBox resources, **Owner** on their own resource group, and subscription-level **Security Reader** for Defender visibility. For manual setups, verify equivalent scoped permissions before testing. Students must be able to create their own VM, manage its extensions, and assess updates without managing other participants' VMs. Do not grant subscription-level Owner or User Access Administrator to perform these exercises.
+
+#### Defender for Servers readiness (organizer)
+
+1. Confirm the Defender for Servers plan approved for the event, including its subscription scope and charges
+2. As an authorized subscription administrator, open **Microsoft Defender for Cloud -> Environment settings** and select the lab subscription
+3. Under **Defender plans**, enable **Servers** with the approved plan if it is not already enabled, and save the changes
+4. Verify that the [Defender for Endpoint integration](https://learn.microsoft.com/azure/defender-for-cloud/enable-defender-for-endpoint) is enabled and that required onboarding settings and extensions can apply to the participant VMs
+5. Verify that participants have **Security Reader** access to review coverage and recommendations. Students verify protection on their own VM; subscription-level plan changes remain an organizer responsibility
 
 ### Step 6: Test the Environment
-Once deployed:
-- Follow Challenge 6 walkthrough for lab exercises verification
+
+Before participants begin, follow the [Challenge 6 walkthrough](../../walkthrough/challenge-06/solution-06.md) using a normal participant identity:
+
+1. Create a Windows Server 2025 VM in that participant's assigned resource group on the prepared LocalBox logical network, with **Enable guest management** selected
+2. Verify that the VM has a valid IP address, working DNS, and outbound access to the required Azure Arc, Defender, and configured Windows update-source endpoints. Confirm **Guest management: Enabled (Connected)** on the VM's **Overview -> Properties -> Configuration** page; see [Enable guest management](https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines#enable-guest-management) if onboarding fails
+3. Confirm that the same VM appears in Defender for Cloud **Inventory**, verify Defender for Servers coverage and onboarding, and review its assessment status. Allow time for recommendations to populate; an empty list is not proof of completed assessment
+4. Locate that VM in Azure Update Manager **Resources -> Machines**, run **Check for updates**, and verify a successful assessment and its timestamp. Zero pending updates is a valid result; a pending or failed assessment is not
+5. Confirm that neither exercise requires selecting shared cluster nodes, the LocalBox host, Arc Resource Bridge, or another participant's VM, or changing subscription-level settings
+
+Resolve connectivity, extension provisioning, or permission failures before the event. Keep any permission changes limited to the operation and resource scope actually required. Do not install patches or restart shared resources during this readiness test.
 
 ## Notes
 
-- **Shared Environment**: For MicroHack events, typically one ArcBox and one LocalBox instance is shared among participants
-- **Resource Costs**: These environments consume significant Azure resources; clean up after the event
+- **Shared Environment**: For MicroHack events, typically one LocalBox instance per subscription is shared among participants; each participant creates a VM in their assigned resource group
+- **Resource Costs**: LocalBox and the enabled security services consume Azure resources; clean up lab resources after the event and review lab-specific paid plans with the subscription owner
 - **Deployment Time**: Plan for deployment time when scheduling your MicroHack
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/deploy-arcbox.ps1 b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/deploy-arcbox.ps1
deleted file mode 100644
index 287ed3d33..000000000
--- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/deploy-arcbox.ps1
+++ /dev/null
@@ -1,163 +0,0 @@
-#Requires -Version 7.0
-
-<#
-.SYNOPSIS
-    Deploy Azure Arc Jumpstart ArcBox for IT Pros environment.
-
-.DESCRIPTION
-    This script deploys the ArcBox for IT Pros environment from Azure Arc Jumpstart.
-    ArcBox provides a pre-packaged Azure Arc sandbox with nested VMs that are
-    automatically onboarded to Azure Arc.
-
-    The deployment uses the official Arc Jumpstart Bicep templates from:
-    https://github.com/microsoft/azure_arc
-
-    ArcBox includes:
-    - ArcBox-Client VM (Windows Server jump host)
-    - Nested VMs: Windows Server and Ubuntu Linux (Arc-enabled)
-    - Log Analytics workspace
-    - Azure Policy assignments for Arc-enabled servers
-
-.PARAMETER ResourceGroupName
-    The name of the resource group to deploy ArcBox to (will be created if it doesn't exist)
-
-.PARAMETER Location
-    Azure region for deployment (default: swedencentral)
-
-.PARAMETER WindowsAdminUsername
-    Admin username for Windows VMs (default: arcdemo)
-
-.PARAMETER DeployBastion
-    Deploy Azure Bastion for secure VM access (default: true)
-
-.PARAMETER Flavor
-    ArcBox flavor to deploy: ITPro, DevOps, DataOps (default: ITPro)
-
-.EXAMPLE
-    .\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox" -Location "swedencentral"
-
-.EXAMPLE
-    .\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox" -Location "westeurope"
-
-.NOTES
-    Author: MicroHack Team
-    Date: January 2026
-
-    Prerequisites:
-    - Azure CLI installed
-    - Sufficient vCPU quota (8 vCPUs)
-    - Required resource providers registered
-
-    Deployment time: ~30 minutes
-
-.LINK
-    https://jumpstart.azure.com/azure_jumpstart_arcbox
-.LINK
-    https://github.com/microsoft/azure_arc/tree/main/azure_jumpstart_arcbox
-#>
-
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory = $true)]
-    [string]$ResourceGroupName,
-
-    [Parameter(Mandatory = $false)]
-    [string]$Location = "swedencentral",
-
-    [Parameter(Mandatory = $false)]
-    [string]$WindowsAdminUsername = "arcdemo",
-
-    [Parameter(Mandatory = $false)]
-    [bool]$DeployBastion = $false,
-
-    [Parameter(Mandatory = $false)]
-    [ValidateSet("ITPro", "DevOps", "DataOps")]
-    [string]$Flavor = "ITPro"
-)
-
-Write-Host "`n=== Azure Arc Jumpstart ArcBox Deployment ===" -ForegroundColor Cyan
-Write-Host "Flavor: $Flavor" -ForegroundColor Gray
-Write-Host "Location: $Location" -ForegroundColor Gray
-Write-Host "Resource Group: $ResourceGroupName" -ForegroundColor Gray
-Write-Host ""
-
-# Check if Azure CLI is installed
-if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
-    Write-Error "Azure CLI is not installed. Please install it from: https://docs.microsoft.com/cli/azure/install-azure-cli"
-    exit 1
-}
-
-# Check if logged in
-$account = az account show 2>$null | ConvertFrom-Json
-if (-not $account) {
-    Write-Host "Not logged in to Azure CLI. Please login..." -ForegroundColor Yellow
-    az login
-    $account = az account show | ConvertFrom-Json
-}
-
-Write-Host "Using subscription: $($account.name)" -ForegroundColor Green
-
-# Prompt for password
-$WindowsAdminPassword = Read-Host -Prompt "Enter admin password for VMs" -MaskInput
-
-# Create resource group if it doesn't exist
-Write-Host "`nCreating resource group '$ResourceGroupName' in '$Location'..." -ForegroundColor Cyan
-az group create --name $ResourceGroupName --location $Location | Out-Null
-
-# Arc Jumpstart ArcBox template URL
-$templateUri = "https://raw.githubusercontent.com/microsoft/azure_arc/main/azure_jumpstart_arcbox/ARM/azuredeploy.json"
-
-Write-Host "`n=== Starting ArcBox Deployment ===" -ForegroundColor Cyan
-Write-Host "This deployment will take approximately 30 minutes to complete." -ForegroundColor Yellow
-Write-Host "You can monitor progress in the Azure Portal under:" -ForegroundColor Gray
-Write-Host "  Resource Groups > $ResourceGroupName > Deployments" -ForegroundColor Gray
-Write-Host ""
-
-# Build deployment parameters
-
-$paramsFile = Join-Path (Split-Path (New-TemporaryFile).FullName) "arcbox-params.json"
-@{
-    "`$schema" = "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#"
-    contentVersion = "1.0.0.0"
-    parameters = @{
-        sshRSAPublicKey = @{ value = $sshRSAPublicKey }
-        windowsAdminUsername = @{ value = $WindowsAdminUsername }
-        windowsAdminPassword = @{ value = $PlainPassword }
-        deployBastion = @{ value = $DeployBastion }
-        flavor = @{ value = $Flavor }
-    }
-} | ConvertTo-Json -Depth 10 | Set-Content $paramsFile
-
-Write-Host "Starting deployment..." -ForegroundColor Cyan
-Write-Host "Template: $templateUri" -ForegroundColor Gray
-Write-Host ""
-
-# Deploy using Azure CLI
-try {
-
-$deploymentName = "arcbox-deployment-$(Get-Random -Maximum 9999)"
-
-    az deployment group create `
-        --name $deploymentName `
-        --resource-group $ResourceGroupName `
-        --template-uri $templateUri `
-        --parameters $paramsFile `
-        --no-wait
-
-    Write-Host "`n=== Deployment Initiated ===" -ForegroundColor Green
-    Write-Host "The ArcBox deployment has been started in the background." -ForegroundColor Gray
-    Write-Host ""
-    Write-Host "To monitor deployment progress:" -ForegroundColor Cyan
-    Write-Host "  1. Azure Portal: Resource Groups > $ResourceGroupName > Deployments" -ForegroundColor Gray
-    Write-Host "  2. Azure CLI: az deployment group show -g $ResourceGroupName -n $deploymentName" -ForegroundColor Gray
-    Write-Host ""
-    Write-Host "Once deployment completes:" -ForegroundColor Cyan
-    Write-Host "  1. Connect to ArcBox-Client VM via Azure Bastion" -ForegroundColor Gray
-    Write-Host "  2. All nested VMs will be automatically onboarded to Azure Arc" -ForegroundColor Gray
-    Write-Host "  3. Arc-enabled servers will appear in the Azure Portal" -ForegroundColor Gray
-    Write-Host ""
-    Write-Host "Documentation: https://jumpstart.azure.com/azure_jumpstart_arcbox" -ForegroundColor Yellow
-} catch {
-    Write-Error "Deployment failed: $($_.Exception.Message)"
-    exit 1
-}
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/img/add_rbac_06.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/img/add_rbac_06.jpg
deleted file mode 100644
index 299b3c11b..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/img/add_rbac_06.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/arcbox_01.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/arcbox_01.jpg
deleted file mode 100644
index 3ef95ebc2..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/arcbox_01.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_01.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_01.jpg
deleted file mode 100644
index 34c22038a..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_01.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_02.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_02.jpg
deleted file mode 100644
index 3dd759239..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_02.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_03.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_03.jpg
deleted file mode 100644
index 0d294fc0f..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/aum_03.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_01.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_01.jpg
deleted file mode 100644
index a41d708d8..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_01.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_02.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_02.jpg
deleted file mode 100644
index 4cec87668..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/dfc_02.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_01.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_01.jpg
deleted file mode 100644
index 824597c2f..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_01.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_02.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_02.jpg
deleted file mode 100644
index 9de8503f3..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_02.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_03.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_03.jpg
deleted file mode 100644
index 550cfdc16..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_03.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_04.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_04.jpg
deleted file mode 100644
index 819244509..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_04.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_05.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_05.jpg
deleted file mode 100644
index 62802a2f3..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_05.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_06.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_06.jpg
deleted file mode 100644
index 5e674fe83..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_06.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_07.jpg b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_07.jpg
deleted file mode 100644
index 1f62074b4..000000000
Binary files a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/images/ssh_posture_07.jpg and /dev/null differ
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/solution-06.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/solution-06.md
index 5acc7aa65..813333fef 100644
--- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/solution-06.md
+++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-06/solution-06.md
@@ -6,10 +6,7 @@
 
 > 💡 **Objective:** Operate a sovereign hybrid cloud environment combining Azure Local and Azure Arc. You'll learn how to apply consistent governance, security, and management across on-premises sovereign infrastructure and Azure.
 
-This challenge uses the Azure Arc Jumpstart environments:
-
-- **ArcBox for IT Pros** - Provides Arc-enabled servers in a sandbox environment
-- **LocalBox** - Simulates an Azure Local on-premises environment
+This challenge uses **Azure Arc Jumpstart LocalBox** to simulate an Azure Local on-premises environment. You will provision your own Windows Server VM and use that same VM for the Defender for Cloud and Azure Update Manager exercises.
 
 ---
 
@@ -19,83 +16,50 @@ Please ensure that you successfully verified the [General prerequisites](../../R
 
 **Additional requirements for this challenge:**
 
-- Access to a pre-deployed ArcBox/LocalBox environment (shared lab or individual deployment)
-- **Reader** and **Azure Stack HCI VM Contributor** role permissions on the resource group containing the hybrid resources
+- Access to a pre-deployed LocalBox environment with Arc Resource Bridge, a VM image, storage, and a logical network ready for VM creation
+- **Reader** and **Azure Stack HCI VM Contributor** role permissions on the resource group containing the shared LocalBox resources
+- Your assigned resource group (for example, `labuser-XX`) with permission to create and manage your VM and its extensions and assess updates. Hosted labs grant **Owner** on your own resource group
+- **Security Reader** access at subscription scope to review Defender for Cloud coverage and recommendations
+- Defender for Servers enabled by the organizer on the lab subscription, using an approved plan and the required Defender for Endpoint integration
+- A guest network with a valid IP address, working DNS, and outbound access to the required Azure Arc, Defender, and configured Windows update-source endpoints
 
 > [!NOTE]
-> ArcBox and LocalBox are typically deployed by the workshop facilitator due to resource requirements and deployment time. If deploying yourself, see the [ArcBox and LocalBox deployment guide](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md).
+> LocalBox is typically deployed by the workshop facilitator due to resource requirements and deployment time. See the [LocalBox deployment and readiness guide](../../resources/demo-vm-creator/README.md). For a personal subscription, an authorized owner must also enable Defender for Servers before this challenge and review the plan's charges. Students in hosted labs should not change subscription-level Defender plans.
 
 ---
 
 ## Lab Environment Architecture
 
-```
-┌─────────────────────────────────────────────────────────────────────┐
-│                         Azure Cloud                                  │
-│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────────┐  │
-│  │   Azure Policy  │  │   Defender for  │  │   Azure Monitor     │  │
-│  │   & Machine     │  │   Cloud         │  │   & Log Analytics   │  │
-│  │   Configuration │  │                 │  │                     │  │
-│  └────────┬────────┘  └────────┬────────┘  └──────────┬──────────┘  │
-│           │                    │                      │             │
-│  ┌────────┴────────────────────┴──────────────────────┴──────────┐  │
-│  │                    Azure Resource Manager                      │  │
-│  └────────┬────────────────────────────────────────────┬─────────┘  │
-│           │                                            │            │
-│  ┌────────┴────────┐                          ┌────────┴─────────┐  │
-│  │  Arc-enabled    │                          │  Azure Local     │  │
-│  │  Servers        │                          │  Instance        │  │
-│  │  (ArcBox)       │                          │  (LocalBox)      │  │
-│  └────────┬────────┘                          └────────┬─────────┘  │
-└───────────┼────────────────────────────────────────────┼────────────┘
-            │              Azure Arc                      │
-┌───────────┴────────────────────────────────────────────┴────────────┐
-│                    On-Premises / Sovereign Private Cloud             │
-│  ┌─────────────────────────┐    ┌───────────────────────────────┐   │
-│  │  Nested VMs             │    │  Azure Local Cluster          │   │
-│  │  - Windows Server       │    │  - Arc Resource Bridge        │   │
-│  │  - Ubuntu Linux         │    │  - Custom Location            │   │
-│  │  - SQL Server           │    │  - VM Gallery Images          │   │
-│  └─────────────────────────┘    └───────────────────────────────┘   │
-└─────────────────────────────────────────────────────────────────────┘
+```text
+Azure management plane
+  Azure Portal / Azure Resource Manager
+    |                                      Defender for Cloud
+    | VM lifecycle management              Azure Update Manager
+    |                                        |
+    v                                        | Guest management
+LocalBox (simulated on-premises environment)  |
+  Azure Local cluster                        |
+    Arc Resource Bridge / Custom Location    |
+    Gallery images / Storage / Network       |
+    |                                        |
+    +--> Your VM: labuserXX-vm-01 <------------+
+           Windows Server 2025
+           Azure Connected Machine agent
+           Azure resource in your assigned resource group
 ```
 
----
+LocalBox runs as a nested lab environment hosted in Azure. In a production sovereign private cloud, Azure Local and the workload VMs run on-premises; Azure provides the connected management plane. Arc Resource Bridge manages VM lifecycle operations, while guest management enables services inside your VM's operating system.
 
-## Task 1: Explore Hybrid Resources in Azure Portal
+---
 
-💡 **Familiarize yourself with the ArcBox and LocalBox resources in Azure Portal to understand the hybrid architecture.**
+## Task 1: Explore LocalBox Resources in Azure Portal
 
-### 1.1 Navigate to the ArcBox Resource Group
+**Familiarize yourself with the LocalBox resources in Azure Portal to understand the hybrid architecture.**
 
 1. Sign in to the [Azure Portal](https://portal.azure.com)
-2. Navigate to **Resource groups**
-3. Locate and select the ArcBox resource group (e.g., `rg-arcbox`)
-4. Review the resources deployed:
-   - **Arc-enabled servers** - Machines connected to Azure via the Connected Machine Agent
-   - **Log Analytics workspace** - Central logging for all hybrid resources
-   - **Virtual Network** - Network infrastructure for the sandbox
-
-💥 **Explore the Arc-enabled servers:**
-
-1. In the Azure portal, navigate to **Azure Arc** by using the search bar at the top, and then navigate to the **Machines** menu option under **Infrastructure**
-![ArcBox](./images/arcbox_01.jpg)
-2. Click on one of the Arc-enabled servers (e.g., `ArcBox-Win2k25`)
-3. Review the **Overview** blade:
-   - Operating system and version
-   - Agent status and version
-   - Resource location (Azure region for metadata)
-   - Machine location (actual physical location)
-4. Check **Settings -> Extensions** to see installed Azure extensions
-5. Navigate through other menu items such as **Monitoring** and **Operations** to see available features and functionality.
-
-🔑 **Key insight:** Arc-enabled servers appear as Azure resources with resource IDs, allowing you to apply Azure management constructs (tags, RBAC, policies) to on-premises machines.
-
-### 1.2 Explore LocalBox resources (if available)
-
-1. Navigate to the LocalBox resource group (e.g., `rg-localbox`)
-2. Locate the **Azure Local** instance resource
-3. Review the following connected resources:
+2. Navigate to the shared LocalBox resource group (e.g., `rg-localbox-shared`)
+3. Locate the **Azure Local** instance resource
+4. Review the following connected resources:
    - **Arc Resource Bridge** - Connects Azure Local to Azure
    - **Custom Location** - Represents the on-premises location for VM deployment
    - **Gallery Images** - VM images available for deployment
@@ -105,59 +69,14 @@ Please ensure that you successfully verified the [General prerequisites](../../R
 
 ---
 
-## Task 2: Governance via Azure Policy and Machine Configuration
-
-💡 **Assign and verify an Azure Policy that uses Machine Configuration to audit security settings on Arc-enabled Linux servers.**
-
-### 2.1 Understanding Machine Configuration
-
-Azure Machine Configuration (formerly Guest Configuration) extends Azure Policy inside the operating system. It uses Desired State Configuration (DSC) to:
-- **Audit** OS-level settings (passwords, services, registry, files)
-- **Enforce/Remediate** configurations when non-compliant
-
-This provides "policy as code" governance across your hybrid environment, similar to Group Policy but managed through Azure.
-
-### 2.2 Assign the Linux SSH Posture Control
-
-💥 **Assign a built-in policy to audit Linux SSH Posture compliance:**
-
-For background and conceptual reference, review the article [What is SSH Posture Control?](https://learn.microsoft.com/azure/osconfig/overview-ssh-posture-control-mc) before proceeding.
-
-#### Azure Portal
-
-1. Navigate to **Azure Policy** in the Azure Portal
-2. Select **Definitions** in the left menu
-3. Search for: `Configure SSH security posture`
-![ArcBox](./images/ssh_posture_04.jpg)
-4. Click on the policy definition **Configure SSH security posture for Linux (powered by OSConfig)** to view details
-5. Click **Assign policy**
-6. Configure the assignment:
-   - **Scope**: Select the resource group containing Arc-enabled servers (e.g. **rg-arcbox**)
-   - **Assignment name**: `labuserXX - Configure SSH security posture for Linux (powered by OSConfig)` (change XX to your suffix)
-   - ![ArcBox](./images/ssh_posture_01.jpg)
-   - Click **Next**
-   - Change **Include Arc connected servers** to **true** and click **Next**
-   - ![ArcBox](./images/ssh_posture_02.jpg)
-7. Click **Next** on the remaining tabs without making any changes to default values, then **Review + create**
-8. ![ArcBox](./images/ssh_posture_03.jpg)
-9. After 15 minutes, navigate to the Arc-enabled server **Arcbox-Ubuntu-01** -> **Operations** -> **Machine Configuration** to see individual configuration status
-10. Click on the **SetLinuxSshServerSecurityBaseline** Configuration Name
-11. ![ArcBox](./images/ssh_posture_06.jpg)
-12. Enable the checkbox **Compliant** to view both compliant and non-compliant SSH settings
-13. ![ArcBox](./images/ssh_posture_07.jpg)
-
-🔑 **Key insight:** Azure Policy with Machine Configuration provides unified compliance visibility across Azure VMs and Arc-enabled servers. This is essential for maintaining sovereign compliance requirements across hybrid environments.
-
----
-
-## Task 3: Deploy a VM on Azure Local via Azure Portal
+## Task 2: Deploy a VM on Azure Local via Azure Portal
 
 💡 **Use Azure Arc VM management to deploy a virtual machine on your Azure Local cluster directly from the Azure Portal.**
 
-> [!NOTE]
-> This task requires access to a LocalBox environment with Arc Resource Bridge configured. If you don't have access, review the steps to understand the process.
+> [!IMPORTANT]
+> Complete this deployment and verify connected guest management before starting Tasks 3 and 4. Both exercises use your own VM, not the LocalBox host, cluster nodes, Arc Resource Bridge, or another participant's VM. Ask the facilitator for access if LocalBox is not available.
 
-### 3.1 Navigate to Azure Local VM Management
+### 2.1 Navigate to Azure Local VM Management
 
 1. In the Azure portal, navigate to **Azure Arc** by using the search bar at the top, and then navigate to the **Azure Local** menu option under **Supported environments**. Click on **All systems**.
 ![Azure Local](./images/localbox_01.jpg)
@@ -166,12 +85,12 @@ For background and conceptual reference, review the article [What is SSH Posture
 4. Select **Virtual machines** option
 5. Click **+ Create VM** to start the VM creation wizard
 
-### 3.2 Configure the Virtual Machine
+### 2.2 Configure the Virtual Machine
 
 💥 **Basic settings:**
 
 1. **Subscription**: Select your subscription (e.g. **Micro-Hack-1**)
-2. **Resource group**: `labuser-XX` (replace XX with your own suffix)
+2. **Resource group**: Select your assigned resource group (e.g., `labuser-XX`; use the exact name provided by the facilitator)
 3. **Virtual machine name**: `labuserXX-vm-01` (replace XX with your own suffix)
 4. **Security type**: Select **Standard**
 
@@ -183,6 +102,8 @@ For background and conceptual reference, review the article [What is SSH Posture
 
 ![Azure Local](./images/localbox_03.jpg)
 
+8. Under **VM extensions**, select **Enable guest management**. This installs the Azure Connected Machine agent so that Defender for Cloud and Azure Update Manager can manage the guest OS.
+
 💥 **Administrator account:**
 
 1. **Username**: `localadmin`
@@ -208,30 +129,34 @@ For **Name** use the same value as for **Virtual machine name**: `labuserXX-vm-0
 For **Network** choose **localbox-vm-lnet-vlan200**
 Select **Add** and then **Next**
 
+The VM needs a valid IP address, working DNS, and outbound connectivity to the required Azure Arc and Defender endpoints and its configured Windows update source. Use the logical network prepared by the facilitator; VM provisioning alone does not prove that guest connectivity works.
+
 ![Azure Local](./images/localbox_07.jpg)
 
 Click **Next** twice
 
 ![Azure Local](./images/localbox_08.jpg)
 
-Click **Create**
-
-![Azure Local](./images/localbox_09.jpg)
-
-### 3.3 Review and Create
+### 2.3 Review and Create
 
 1. Review all settings
 2. Click **Create** to deploy the VM
 
+![Azure Local](./images/localbox_09.jpg)
 
-### 3.4 Validate VM Deployment
+### 2.4 Validate VM Deployment and Guest Management
 
 1. Click **Go to resource** when the deployment is finished
 2. Verify the VM is running
 3. Review the VM properties and available operations
+4. On **Overview -> Properties -> Configuration**, verify that **Guest management** shows **Enabled (Connected)**
+5. Record your VM name, subscription, resource group, and resource ID. Use this same VM in the following exercises
 
 ![Azure Local](./images/localbox_10.jpg)
 
+> [!IMPORTANT]
+> If guest management is disabled or still connecting, resolve this before continuing. Check the guest network with the facilitator and follow [Enable guest management on an Azure Local VM](https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines#enable-guest-management). Do not separately onboard a duplicate Arc-enabled server resource for a VM whose guest management is already connected.
+
 🔑 **Key insight:** Azure Arc VM management enables self-service VM provisioning on Azure Local using familiar Azure tools and RBAC. This allows organizations to maintain data sovereignty by keeping workloads on-premises while benefiting from Azure management capabilities.
 
 #### **Bonus tip**
@@ -246,141 +171,123 @@ To learn more, see [SSH access to Azure Arc-enabled servers](https://learn.micro
 
 ---
 
-## Task 4: Security Monitoring with Microsoft Defender for Cloud
-
-💡 **Enable Microsoft Defender for Cloud and review security recommendations for your Arc-enabled resources.**
-
-### 4.1 Enable Defender for Servers
-
-💥 **Enable Defender for Servers on your subscription:**
+## Task 3: Security Monitoring with Microsoft Defender for Cloud
 
-**Azure Portal**
+**Verify Defender for Servers coverage and review security recommendations for the VM you created in Task 2.**
 
-1. Navigate to **Microsoft Defender for Cloud**
-2. Select **Management -> Environment settings** in the left menu
-3. Expand your **Tenant Root Group** and select your subscription
-4. Under **Defender plans**, locate **Servers**
-5. If not already enabled, toggle to **On** (select Plan 1 or Plan 2 based on requirements)
-6. Review available features when selecting **Change plan** and **Settings** for the **Servers** plan.
-7. Click **Save**
+### 3.1 Verify Coverage for Your VM
 
-### 4.2 Review Security Posture
+1. Navigate to **Microsoft Defender for Cloud** in the Azure Portal
+2. Open **Inventory** and filter by your subscription and assigned resource group
+3. Search for `labuserXX-vm-01` (using your own suffix). Match its resource ID to the VM recorded in Task 2, rather than selecting a shared machine with a similar name
+4. Open the resource details and review its Defender for Servers coverage and onboarding status. The organizer should already have enabled the approved Servers plan and Defender for Endpoint integration
 
-1. Navigate to **Microsoft Defender for Cloud** -> **General** -> **Overview**
-2. Review the **Secure Score** for your environment
-3. Click on **Recommendations** to see security recommendations
+![Screenshot placeholder: Defender for Servers coverage and onboarding status for your Azure Local VM](./images/dfc_01.jpg)
 
-![Defender for Cloud](./images/dfc_01.jpg)
-
-💥 **Filter for Arc-enabled servers:**
+> [!NOTE]
+> A newly created VM can take time to appear and complete onboarding. If it is missing, first recheck **Guest management: Enabled (Connected)** and the selected subscription/resource group, then refresh Inventory. Ask the facilitator to check plan coverage and extension onboarding if it remains missing or unprotected. An Inventory entry alone does not prove that Defender for Servers protection is active. Do not enable a paid subscription-level plan yourself in a hosted lab.
 
-1. In **Recommendations**, use filters:
-   - **Resource type**: `Machine - Azure Arc`
-2. Review recommendations specific to your Arc-enabled servers
+### 3.2 Review Your VM's Security Posture
 
-![Defender for Cloud](./images/dfc_02.jpg)
+1. From your VM's resource details, open its **Recommendations**
+2. Review the assessment status and any recommendations for that VM. If navigating from the subscription-wide **Recommendations** view, verify the affected resource is your VM by resource ID
+3. For an available recommendation, inspect its severity, reason, and remediation guidance
 
-### 4.3 Explore Common Recommendations for Arc-enabled Servers
+![Screenshot placeholder: Defender for Cloud recommendations and assessment status for your Azure Local VM](./images/dfc_02.jpg)
 
-You may see recommendations such as:
+Depending on the enabled plan and completed assessments, recommendations may concern:
 
-| Recommendation | Severity | Description |
-|----------------|----------|-------------|
-| Guest configuration extension should be installed | High | Required for Machine Configuration policies |
-| System updates should be installed | High | OS patches are available |
-| Endpoint protection should be installed | High | Antimalware solution needed |
-| Azure Monitor agent should be installed | Medium | Required for advanced monitoring |
-| Vulnerabilities should be remediated | Varies | Software vulnerabilities detected |
+| Area | What to investigate |
+|------|---------------------|
+| System updates | Missing OS security updates |
+| Endpoint protection | Defender for Endpoint onboarding or protection status |
+| Vulnerabilities | Detected software vulnerabilities and remediation guidance |
 
-💥 **Investigate a recommendation:**
+Only investigate or remediate your own VM. Do not apply subscription-wide fixes or change shared LocalBox infrastructure as part of this exercise.
 
-1. Click on a recommendation to see affected resources
-2. Review the remediation steps provided
-3. For quick fixes, use the **Fix** button if available
+> [!NOTE]
+> Recommendations may still be pending on a fresh VM, and an assessed VM may have no active recommendations. Record the displayed assessment status separately from the verified protection status. An empty recommendations list does not demonstrate completed assessment or compliance. You can complete Task 4 while waiting, then return to review your VM's results.
 
-### 4.4 Review Security Alerts (if any)
+### 3.3 Review Security Alerts (if any)
 
 1. Navigate to **Security alerts** in Defender for Cloud
-2. Review any active alerts for your hybrid resources
-3. Click on an alert to see:
+2. Filter by your subscription and inspect only alerts whose affected resource matches your VM's resource ID
+3. If an alert exists, review:
    - Attack description
    - Affected resources
    - Recommended actions
 
+No alerts is an expected outcome for a new lab VM; do not generate an alert or select another participant's resources to complete this step.
+
 🔑 **Key insight:** Microsoft Defender for Cloud provides unified security management across Azure and Arc-enabled resources. This enables consistent security posture management for sovereign hybrid deployments.
 
 ---
 
-## Task 5: Explore Azure Update Manager for Hybrid Patching
+## Task 4: Assess Your VM with Azure Update Manager
 
-💡 **Use Azure Update Manager to assess and manage OS updates across your Arc-connected machines.**
+**Use Azure Update Manager to assess OS updates on the same Windows Server VM you created in Task 2.**
 
-### 5.1 Navigate to Azure Update Manager
+### 4.1 Locate Your VM
 
-1. In the Azure Portal, search for **Azure Update Manager** in the middle-top search bar
-2. Go to **Overview** to review the dashboard overview showing:
-   - Machines pending updates
-   - Compliance status
-   - Recent update deployments
+1. In the Azure Portal, search for **Azure Update Manager**
+2. Select **Resources -> Machines**
+3. Filter by your subscription and assigned resource group, then search for `labuserXX-vm-01` (using your own suffix)
+4. Select your VM and verify its resource ID matches the VM recorded in Task 2. Azure Local guest VMs use Azure Arc guest management; do not select the shared cluster nodes, LocalBox host, or Arc Resource Bridge
 
-### 5.2 Assess Update Compliance
+![Screenshot placeholder: Azure Update Manager Machines view filtered to your Azure Local VM and assigned resource group](./images/aum_01.jpg)
 
-💥 **Check update status for Arc-enabled servers:**
+> [!IMPORTANT]
+> This exercise assesses the guest operating system of your VM. It does not update the Azure Local cluster infrastructure. If your VM is not listed, recheck its running state, connected guest management, and your filters before continuing. Ask the facilitator to verify permissions and connectivity if needed.
 
-1. Select **Resources -> Machines** in the left menu
-2. Filter by:
-   - **Machine type**: `Arc-enabled servers`
-   - **Resource group**: Your ArcBox resource group (e.g. **rg-arcbox**)
-![Azure Update Manager](./images/aum_01.jpg)
-3. Review the update status for one machine
-![Azure Update Manager](./images/aum_02.jpg)
+### 4.2 Trigger an Update Assessment
 
-### 5.3 Trigger an Update Assessment
+1. Review the current update assessment status for your VM. A new VM may not have been assessed yet
+2. Click **Check for updates** and confirm that only your VM is selected
+3. Wait for the assessment to finish, then refresh the VM's update status and verify the latest assessment time and successful result
 
-1. Select an Arc-enabled server
-2. Click **Check for updates**
-![Azure Update Manager](./images/aum_03.jpg)
-1. Wait for the assessment to complete
+![Screenshot placeholder: Azure Update Manager Check for updates action targeting only your Azure Local VM](./images/aum_02.jpg)
 
-### 5.4 Review Available Updates
+The first assessment can take additional time while the required update extension is deployed. If the assessment fails, review the error and check guest connectivity, extension provisioning, permissions, and access to the configured Windows update source with the facilitator. A pending or failed assessment is not a successful result.
 
-1. Click on the previously selected machine to see an updated status
-2. Review:
+### 4.3 Review Available Updates
+
+1. Open the completed assessment results for your VM
+2. Review the available update classifications, such as:
    - **Critical and security updates** - High priority
    - **Other updates** - Feature and quality updates
    - **Definition updates** - Antimalware definitions
+3. Record the assessment time and pending update counts. A successful assessment with zero pending updates is also a valid outcome
+
+![Screenshot placeholder: Successful update assessment for your Azure Local VM showing the assessment time and pending update counts](./images/aum_03.jpg)
+
+This exercise stops at assessment. Do not install updates, schedule patching, or restart shared resources.
 
 🔑 **Key insight:** Azure Update Manager provides centralized patch management across Azure VMs and Arc-enabled servers. This is critical for maintaining security compliance in sovereign environments where you need to control when and how updates are applied.
 
 ---
 
-## Task 6: Wrap-up and Discussion
+## Task 5: Wrap-up and Discussion
 
-### 6.1 Review Key Learnings
+### 5.1 Review Key Learnings
 
 After completing this challenge, you should understand:
 
 ✅ **Azure Arc as the Hybrid Bridge**
-- Arc-enabled servers represent on-premises machines as Azure resources
+- Azure Local VMs are represented as Azure resources
 - Enables unified management through Azure Resource Manager
 - Supports Azure RBAC, tags, and policies for hybrid resources
 
-✅ **Sovereign Hybrid Governance**
-- Azure Policy with Machine Configuration extends compliance to the OS level
-- Provides consistent governance across cloud and on-premises
-- Essential for meeting sovereign regulatory requirements
-
 ✅ **Azure Local as Sovereign Private Cloud**
 - Azure Local enables sovereign on-premises cloud infrastructure
 - Arc Resource Bridge connects Azure Local to Azure management plane
 - Self-service VM provisioning using Azure Portal (also available via CLI and Infrastructure as Code)
 
 ✅ **Security and Compliance**
-- Microsoft Defender for Cloud provides unified security posture management
-- Azure Update Manager enables centralized patch management
-- Consistent security monitoring across hybrid estate
+- Connected guest management enables Azure services inside your VM's operating system
+- Microsoft Defender for Cloud provides security coverage and recommendations for your VM
+- Azure Update Manager assesses updates on that same VM without changing shared infrastructure
 
-### 6.2 Real-World Applications
+### 5.2 Real-World Applications
 
 Consider how these capabilities apply to sovereign cloud scenarios:
 
@@ -392,7 +299,7 @@ Consider how these capabilities apply to sovereign cloud scenarios:
 | Operational efficiency | Single control plane for hybrid management |
 | Disaster recovery | Azure Site Recovery integration for failover |
 
-### 6.3 Further Exploration
+### 5.3 Further Exploration
 
 For additional learning, explore:
 
@@ -406,13 +313,10 @@ For additional learning, explore:
 
 Before completing this challenge, verify:
 
-- [ ] You can navigate and understand the ArcBox/LocalBox hybrid environment in the Azure Portal
-- [ ] You have assigned at least one Azure Policy (e.g., SSH Posture Control) to Arc-enabled servers
-- [ ] You can verify the compliance status of Arc-enabled servers in the Azure Policy dashboard
-- [ ] You can verify the compliance status of Arc-enabled servers in the Azure Machine Configuration blade
-- [ ] You have deployed a VM on Azure Local via the Azure Portal
-- [ ] You have enabled or verified Defender for Cloud coverage and reviewed security recommendations
-- [ ] You can navigate Azure Update Manager for hybrid patching
+- [ ] You can navigate and understand the LocalBox hybrid environment in the Azure Portal
+- [ ] You have deployed your own VM on Azure Local and verified that guest management is Enabled (Connected)
+- [ ] You have verified Defender for Servers coverage for your VM and reviewed its available recommendations, or recorded that its assessment is still pending
+- [ ] You have completed an Azure Update Manager assessment for your VM and reviewed its timestamp and results, including when no updates are pending
 - [ ] You understand how Azure Arc provides a unified control plane for sovereign hybrid scenarios
 
 ---