Jan Egil Ring (janegilring) · Sep 18, 2026 · Sep 18, 2026
diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/Readme.md
@@ -62,7 +62,7 @@ In order to use the MicroHack time most effectively, the following tasks should
 
 1. Your own Azure subscription with Owner RBAC rights at the subscription level
 2. Contributor or Owner permissions on your subscription or resource group
-3. Optional: Access to Azure Arc Jumpstart ArcBox & LocalBox for hybrid challenges
+3. Access to Azure Arc Jumpstart LocalBox if completing Challenge 6, including the [guest-management and Defender readiness checks](./resources/demo-vm-creator/README.md#step-6-test-the-environment)
 4. [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli). **Hint:** Make sure to use the latest version available.
 5. Challenge 7: `kubectl`, `jq`, OpenSSL, the [Radius CLI](https://docs.radapp.io/getting-started/install/), and the Azure CLI `bastion` extension
 
@@ -92,17 +92,16 @@ Use the AZQR report for planning and preferred-region ordering, not as the deplo
 
 The main cost driver for this MicroHack is virtual machines:
 
-- **ArcBox for ITPro** cost is approximately 7 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 30-40 USD.
 - **LocalBox** cost is approximately 100-110 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 5-600 USD.
 - **Challenges 4, 5, and 7** share one pre-provisioned participant platform: a two-node AKS system pool, one Confidential VM AKS node, one standalone Confidential VM, one K3s VM, Azure Bastion Standard, and a NAT Gateway. Budget approximately 45-55 USD per participant per day, depending on region and data transfer. The platform starts during lab deployment so participants can focus on validation rather than waiting for capacity-sensitive resources.
 - Plan subscription quotas for at least 12 general-purpose vCPUs and 4 DCasv5- or DCasv6-family confidential vCPUs per participant. Keep the default maximum of two participants per subscription unless larger aggregate increases have been approved in advance.
 
-For a 50-participant event, the shared participant platforms cost approximately 2,250-2,750 USD per day while deployed, in addition to the optional ArcBox and LocalBox environments.
-There will also be smaller costs for services such as Key Vault, storage, and monitoring.
+For a 50-participant event, the shared participant platforms cost approximately 2,250-2,750 USD per day while deployed, in addition to the optional LocalBox environment.
+There will also be smaller costs for services such as Key Vault, storage, and monitoring. Budget separately for the approved Defender for Servers plan used in Challenge 6.
 An Azure Pricing Calculator estimate is available [here](https://azure.com/e/1a7aec76a3e049cba57cda6742025373).
 This estimate can be adjusted for fewer/more students, running the VMs shorter/longer and adding additional services if desired.
 
-If you plan to run this MicroHack in your own subscription on a limited budget, skip the optional Challenge 6 environments and remove the participant resource group immediately after finishing the event.
+If you plan to run this MicroHack in your own subscription on a limited budget, skip the optional Challenge 6 environment and remove the participant resource group immediately after finishing the event.
 
 ## Contributors
 

diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md
@@ -4,41 +4,36 @@
 
 ## Goal
 
-The goal of this challenge is to operate a sovereign hybrid cloud environment by combining Microsoft Sovereign Public Cloud and Sovereign Private Cloud components. You will work with Azure Local and Arc-enabled Servers (simulated via Arc Jumpstart ArcBox and LocalBox) as a sovereign on-premises cloud environment and use Azure Arc to bridge on-premises resources with Azure for unified governance, security, and management.
+The goal of this challenge is to operate a sovereign hybrid cloud environment by combining Microsoft Sovereign Public Cloud and Sovereign Private Cloud components. You will work with Azure Local, simulated via Azure Arc Jumpstart LocalBox, and provision your own VM. You will use Azure Arc to manage that VM through Azure, review its security posture with Microsoft Defender for Cloud, and assess its OS updates with Azure Update Manager.
 
 ## Scenario
 
 Your organization must run workloads in a sovereign cloud while still leveraging Azure's management and governance capabilities. Azure Local represents your sovereign on-premises infrastructure, and Azure Arc enables you to apply consistent governance across your hybrid estate.
 
 ## Actions
 
-* Explore the ArcBox and LocalBox hybrid infrastructure in the Azure Portal
-* Navigate Arc-enabled servers and understand their Azure resource representation
-* Assign Azure Policy with Machine Configuration to audit/enforce OS settings on Arc-enabled Linux servers
-* Deploy a VM on Azure Local using Azure Arc VM management
-* Enable and review Microsoft Defender for Cloud security posture for Arc-enabled resources
-* Explore Azure Update Manager for hybrid patching across Arc-connected machines
+* Explore the LocalBox hybrid infrastructure in the Azure Portal
+* Deploy your own VM on Azure Local using Azure Arc VM management and verify that guest management is connected
+* Verify Microsoft Defender for Cloud coverage and review security recommendations for the VM you provisioned
+* Use Azure Update Manager to assess OS updates on the VM you provisioned
 
 ## Success criteria
 
-* You can navigate and understand the ArcBox/LocalBox hybrid environment in the Azure Portal
-* You have successfully assigned an Azure Policy (e.g., SSH Posture Control) to Arc-enabled servers
-* You can verify the compliance status of Arc-enabled servers in the Azure Policy dashboard
-* You can verify the compliance status of Arc-enabled servers in the Azure Machine Configuration blade
-* You have deployed a VM on Azure Local via the Azure Portal
-* You have enabled Microsoft Defender for Cloud and reviewed security recommendations for hybrid resources
+* You can navigate and understand the LocalBox hybrid environment in the Azure Portal
+* You have deployed your own VM on Azure Local via the Azure Portal and verified that guest management is Enabled (Connected)
+* You have verified Defender for Servers coverage for your VM and reviewed its available recommendations, or identified that its assessment is still pending
+* You have completed an Azure Update Manager assessment for your VM and reviewed the results, including when no updates are pending
 * You understand how Azure Arc provides a unified control plane for sovereign hybrid scenarios
 
 ## Learning resources
 
-* [Azure Arc-enabled Servers overview](https://learn.microsoft.com/azure/azure-arc/servers/overview)
+* [Azure Arc-enabled Servers overview (background for guest management)](https://learn.microsoft.com/azure/azure-arc/servers/overview)
 * [Azure Local hybrid capabilities](https://learn.microsoft.com/azure/azure-local/hybrid-capabilities-with-azure-services-23h2)
-* [Azure Machine Configuration (Guest Configuration)](https://learn.microsoft.com/azure/governance/machine-configuration/overview)
-* [What is SSH Posture Control?](https://learn.microsoft.com/azure/osconfig/overview-ssh-posture-control-mc)
-* [Azure Policy built-in definitions for Arc-enabled servers](https://learn.microsoft.com/azure/azure-arc/servers/policy-reference)
+* [Create Azure Local VMs](https://learn.microsoft.com/azure/azure-local/manage/create-arc-virtual-machines)
+* [Enable guest management on Azure Local VMs](https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines#enable-guest-management)
 * [Microsoft Defender for Cloud with Arc-enabled servers](https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-machines)
+* [Azure Update Manager overview](https://learn.microsoft.com/azure/update-manager/overview)
 * [Azure Arc Jumpstart - LocalBox](https://jumpstart.azure.com/azure_jumpstart_localbox)
-* [Govern Azure Arc-enabled servers (Microsoft Learn Training)](https://learn.microsoft.com/training/modules/govern-azure-arc-enabled-servers/)
 
 ## Solution
 

diff --git a/...ure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md b/...ure/01-03-Infrastructure/01_Sovereign_Cloud/resources/demo-vm-creator/README.md
@@ -1,41 +1,17 @@
-# Deploy Azure Arc Jumpstart Lab Environments
+# Deploy Azure Arc Jumpstart LocalBox
 
-This folder contains scripts to deploy lab environments for the Sovereign Cloud MicroHack using Azure Arc Jumpstart.
+This folder contains the manual deployment entry point and preparation instructions for the Sovereign Cloud MicroHack's Azure Arc Jumpstart LocalBox environment.
 
 ## Overview
 
-For Challenge 6 (Operating a Sovereign Hybrid Cloud with Azure Arc & Azure Local), we leverage the official Azure Arc Jumpstart environments rather than creating custom templates. This ensures:
+For Challenge 6 (Operating a Sovereign Hybrid Cloud with Azure Arc & Azure Local), we use the official Azure Arc Jumpstart LocalBox environment. Participants provision their own Azure Local VMs and use those VMs for the Defender for Cloud and Azure Update Manager exercises. This provides:
 
 - **Maintained templates** - Arc Jumpstart is actively maintained by Microsoft
 - **Latest features** - Always uses the newest Azure Arc and Azure Local capabilities
 - **Validated configurations** - Tested and proven deployment patterns
 - **Comprehensive documentation** - Extensive guides available
 
-## Available Environments
-
-### 1. ArcBox for IT Pros
-A pre-packaged Azure Arc sandbox environment with nested VMs onboarded to Azure Arc.
-
-**Features:**
-- Multiple Arc-enabled servers (Windows and Linux)
-- Pre-configured Azure Arc extensions
-- Log Analytics workspace integration
-- Azure Policy integration
-
-**Requirements:**
-- 8 vCPUs
-- ~30 minutes deployment time
-
-**Deployment:**
-```powershell
-.\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox-shared" -Location "swedencentral"
-```
-
-**Cost**
-
-ArcBox for ITPro cost is approximately 7 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 30-40 USD.
-
-### 2. LocalBox
+## LocalBox
 Azure Local environment simulating an on-premises private cloud.
 
 **Features:**
@@ -57,9 +33,10 @@ Azure Local environment simulating an on-premises private cloud.
 
 LocalBox cost is approximately 100-110 USD per day. We recommend setting it up the week before the event, so for example 5 days before the event would result in a cost between 5-600 USD.
 
+Budget separately for the approved Defender for Servers plan and review its scope and charges before enabling it on the shared subscription.
+
 ## Arc Jumpstart Resources
 
-- **ArcBox Documentation**: https://jumpstart.azure.com/azure_jumpstart_arcbox
 - **LocalBox Documentation**: https://jumpstart.azure.com/azure_jumpstart_localbox
 - **GitHub Repository**: https://github.com/microsoft/azure_arc
 
@@ -72,18 +49,14 @@ Before deploying, ensure you have:
 3. Azure CLI and Az PowerShell modules installed
 
 ### Step 2: Deploy Environment
-Choose the appropriate deployment script:
+Run the LocalBox deployment script:
 
 ```powershell
-# For Arc-enabled servers challenge
-.\deploy-arcbox.ps1 -ResourceGroupName "rg-arcbox-shared" -Location "swedencentral"
-
-# For Azure Local challenge
 .\deploy-localbox.ps1 -ResourceGroupName "rg-localbox-shared" -Location "swedencentral"
 ```
 
 ### Step 3: Wait for Deployment
-Deployments can take 2-6 hours depending on the environment. Monitor progress in:
+LocalBox provisioning can take 4-6 hours, with additional time for the VM image and preparation steps below. Monitor progress in:
 - Azure Portal > Resource Groups > Deployments
 
 #### Hackathons console deployment behavior
@@ -243,7 +216,7 @@ You should also see updated values in the Azure Portal:
 6. Select **Review + create** and wait for the deployment to finish
 
 Role assignments:
-1. In the Azure Portal, navigate to your resource group where LocalBox is deployed (e.g. rg-localbox)
+1. In the Azure Portal, navigate to your resource group where LocalBox is deployed (e.g. `rg-localbox-shared`)
 2. Select **Access control (IAM)** in the left menu
 3. Click **+ Add -> Add role assignment** to start the role assignment wizard
 ![Create role assignment](./img/add_rbac_01.jpg)
@@ -256,16 +229,31 @@ Role assignments:
 ![Create role assignment](./img/add_rbac_04.jpg)
 8. Repeat steps 1-7 to add a role assignment for the **Azure Stack HCI VM Contributor** role
 ![Create role assignment](./img/add_rbac_05.jpg)
-8. Repeat steps 1-7 to add a role assignment for the **Reader** role and **User Access Administrator** role for the resource group where **ArcBox** is deployed (e.g. rg-arcbox)
-- For the **User Access Administrator** role, select **Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)** on the **Conditions** tab:
-![Create role assignment](./img/add_rbac_06.jpg)
+
+Hosted lab automation grants participants access to shared LocalBox resources, **Owner** on their own resource group, and subscription-level **Security Reader** for Defender visibility. For manual setups, verify equivalent scoped permissions before testing. Students must be able to create their own VM, manage its extensions, and assess updates without managing other participants' VMs. Do not grant subscription-level Owner or User Access Administrator to perform these exercises.
+
+#### Defender for Servers readiness (organizer)
+
+1. Confirm the Defender for Servers plan approved for the event, including its subscription scope and charges
+2. As an authorized subscription administrator, open **Microsoft Defender for Cloud -> Environment settings** and select the lab subscription
+3. Under **Defender plans**, enable **Servers** with the approved plan if it is not already enabled, and save the changes
+4. Verify that the [Defender for Endpoint integration](https://learn.microsoft.com/azure/defender-for-cloud/enable-defender-for-endpoint) is enabled and that required onboarding settings and extensions can apply to the participant VMs
+5. Verify that participants have **Security Reader** access to review coverage and recommendations. Students verify protection on their own VM; subscription-level plan changes remain an organizer responsibility
 
 ### Step 6: Test the Environment
-Once deployed:
-- Follow Challenge 6 walkthrough for lab exercises verification
+
+Before participants begin, follow the [Challenge 6 walkthrough](../../walkthrough/challenge-06/solution-06.md) using a normal participant identity:
+
+1. Create a Windows Server 2025 VM in that participant's assigned resource group on the prepared LocalBox logical network, with **Enable guest management** selected
+2. Verify that the VM has a valid IP address, working DNS, and outbound access to the required Azure Arc, Defender, and configured Windows update-source endpoints. Confirm **Guest management: Enabled (Connected)** on the VM's **Overview -> Properties -> Configuration** page; see [Enable guest management](https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines#enable-guest-management) if onboarding fails
+3. Confirm that the same VM appears in Defender for Cloud **Inventory**, verify Defender for Servers coverage and onboarding, and review its assessment status. Allow time for recommendations to populate; an empty list is not proof of completed assessment
+4. Locate that VM in Azure Update Manager **Resources -> Machines**, run **Check for updates**, and verify a successful assessment and its timestamp. Zero pending updates is a valid result; a pending or failed assessment is not
+5. Confirm that neither exercise requires selecting shared cluster nodes, the LocalBox host, Arc Resource Bridge, or another participant's VM, or changing subscription-level settings
+
+Resolve connectivity, extension provisioning, or permission failures before the event. Keep any permission changes limited to the operation and resource scope actually required. Do not install patches or restart shared resources during this readiness test.
 
 ## Notes
 
-- **Shared Environment**: For MicroHack events, typically one ArcBox and one LocalBox instance is shared among participants
-- **Resource Costs**: These environments consume significant Azure resources; clean up after the event
+- **Shared Environment**: For MicroHack events, typically one LocalBox instance per subscription is shared among participants; each participant creates a VM in their assigned resource group
+- **Resource Costs**: LocalBox and the enabled security services consume Azure resources; clean up lab resources after the event and review lab-specific paid plans with the subscription owner
 - **Deployment Time**: Plan for deployment time when scheduling your MicroHack