Sov Cloud - Update LocalBox setup

03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/challenges/challenge-06.md

@@ -19,6 +19,16 @@ Before starting, return your Challenge 1 exercise policies to **DoNotEnforce**.
 * Verify Microsoft Defender for Cloud coverage and review security recommendations for the VM you provisioned
 * Use Azure Update Manager to assess OS updates on the VM you provisioned
 
+MDE onboarding can take up to an hour after Arc connects when Endpoint integration
+is already established. Continue with Update Manager and the AKS tasks while waiting.
+Recommendations may appear later; you do not need a nonzero count to complete the
+challenge. Record pending assessment separately from confirmed protection.
+
+If your facilitator provides `sov-ref-vm`, inspect its existing Defender and Update
+Manager results while your own VM onboards. **Do not modify, run assessments on,
+patch, restart or delete this shared VM.** Still complete the deployment and
+assessment steps on your own VM, and record which VM each observation describes.
+
 ### Review the AKS load balancer and deploy an app
 
 * Review the preinstalled **MetalLB load balancer**: check that it is healthy and understand how it assigns IP addresses to applications
@@ -34,7 +44,7 @@ In a real deployment, clients would reach the app through its MetalLB IP address
 
 * You can navigate and understand the LocalBox hybrid environment in the Azure Portal
 * You have deployed your own VM on Azure Local via the Azure Portal and verified that guest management is Enabled (Connected)
-* You have verified Defender for Servers coverage for your VM and reviewed its available recommendations, or identified that its assessment is still pending
+* You have verified Defender for Servers plan coverage, recorded MDE extension/onboarding status separately, and reviewed available recommendations or recorded that assessment is pending/not yet confirmed
 * You have completed an Azure Update Manager assessment for your VM and reviewed the results, including when no updates are pending
 * You can explain MetalLB's role and have checked that the preinstalled load balancer is healthy
 * Your sample application runs in your team's namespace and has a load-balancer IP address

03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/hosted-events/readme.md

@@ -47,6 +47,7 @@ The shared hook submits `localbox-*` in `rg-localbox-shared`, then waits up to s
 2. If the Client password is unknown, an authorized event lead/coach uses the Azure VM's **Help > Reset password** to set a known password for the `arcdemo` host account, then connects to `LocalBox-Client` through Bastion. Do not expose this password through participant credentials or job logs. A host password reset does not change the nested-node Windows credentials. See [LocalBox credentials](#localbox-credentials).
 3. Copy **Lab Group ObjectId** from the Console's **Credentials** tab for the preparation prompt or `-AksAdminGroupObjectId`. Confirm that intended Azure lab identities/coaches are members; see the group dependency below.
 4. Follow [LocalBox preparation](../localbox/readme.md), once per shared subscription, in elevated PowerShell 7. It creates AKS and then installs/verifies the shared MetalLB extension and reserved ARP pool. Azure authentication uses the Client VM's managed identity; preparation constructs the nested Windows credential locally from the installed configuration without printing it. An explicit `-NodeCredential` overrides that value after a nested-account rotation.
+   Preparation includes `sov-ref-vm` by default; run it **the day before the event** for inspection while participant VMs onboard, or opt out with `-IncludeReferenceVm:$false`. Follow the [reference readiness checks](../localbox/readme.md#reference-readiness-and-participant-use); Console plan configuration and successful provisioning do not establish completed VM assessments. Participants must not modify this shared VM; no RBAC restrictions are added.
 5. Run [Pester health checks](../tests/readme.md) for LocalBox and every selected participant lab. A control-plane-only pass does not establish full readiness.
 6. Console shared setup enables and verifies **Defender for Servers Plan 2** and **Endpoint protection** on every event subscription. Complete the [Defender readiness checklist](../localbox/manual-preparation.md#defender-for-servers-readiness-organizer) and [participant VM readiness exercise](../localbox/manual-preparation.md#step-6-test-the-environment), including guest management, actual Defender onboarding and Update Manager. Verified subscription settings do not prove that a VM has completed onboarding.
 7. Verify an intended participant can use Entra-authenticated `az connectedk8s proxy` and a private application port-forward from their Codespace. Participants inspect MetalLB, not install it, and never need LocalBox-Client access. This validates the lab access path, not routing to the MetalLB service VIP.

03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/localbox/manual-preparation.md

@@ -54,7 +54,7 @@ You should also see updated values in the Azure Portal:
 ![Create logical network](./img/add_logical_network_02.jpg)
 5. Enter the following parameter values:
 - **IPv4 address space**: 192.168.200.0 /24 (256 addresses)
-- **IP Pools**: 192.168.200.10 - 192.168.200.199, only after verifying DHCP exclusions and infrastructure reservations; never include the network, broadcast or gateway addresses
+- **IP Pools**: 192.168.200.10 - 192.168.200.199 for the standard greenfield LocalBox configuration. For customized networks, verify DHCP exclusions and infrastructure reservations; never include the network, broadcast or gateway addresses
 - **Default gateway**: 192.168.200.1
 - **DNS Servers**: 192.168.1.254
 - **VLAN ID**: 200
@@ -116,6 +116,8 @@ do not repeatedly toggle integration to force deployment.
 
 ### Step 6: Test the Environment
 
+The preparation script includes a [reference VM](readme.md#reference-vm) by default; verify its assessment results before the event, or opt out with `-IncludeReferenceVm:$false`. This does not replace the participant-identity test below.
+
 Before participants begin, follow the [Challenge 6 walkthrough](../../walkthrough/challenge-06/solution-06.md) using a normal participant identity:
 
 1. Create a Windows Server 2025 VM in that participant's assigned resource group on the prepared LocalBox logical network, with **Enable guest management** selected