Add hosted deployment and harden the migration Hack

03-Azure/01-03-Infrastructure/06_Migration_Secure_AI_Ready/Readme.md

@@ -46,7 +46,12 @@ The Hack follows a coherent modernization storyline:
 6. **Operate intelligently** with Azure Monitor telemetry, alerting, and AI-assisted investigation.
 7. **Replatform** the selected static IIS or Apache workload to Azure App Service and evaluate the optimal production hosting target.
 
-The lab simulates an on-premises datacenter by running nested guest VMs on a Hyper-V host in an Azure source resource group. Azure Migrate discovers, assesses, and migrates those systems into a destination resource group. In the final challenges, each team operates and manually replatforms either the migrated Windows/IIS workload or the migrated Ubuntu/Apache workload.
+Each learner receives one pre-created resource group, shown as `<YOUR-LAB-RESOURCE-GROUP>` in these instructions. It contains both the simulated on-premises environment and the migration destination: the source VNet (`10.1.0.0/16`) hosts a Hyper-V server with four nested VMs, while the destination VNet (`10.2.0.0/16`) receives the migrated web VMs. Both networks retain NAT Gateway outbound connectivity and Azure Bastion access. Fresh Console labs use the learner number from the RG name: for example, `rg-labuser-0013` receives the host `mh-0013-hv`. Existing Console labs and nonstandard Console RG names retain their deterministic hash-based names; retries never rename resources. For either deployment option, use the actual resource names supplied for your lab.
+
+Instructors predeploy only the Challenge 1 infrastructure, using either Hackbox Console or the [manual Azure deployment](resources/README.md#option-2-manual-deployment), and verify all four nested VMs and both web dashboards before handoff. Completed Console deployment reruns reuse that baseline without restarting source guests that migration may have stopped. Discovery, assessment, migration, monitoring, and App Service remain learner exercises. In the final challenges, each team operates and manually replatforms either the migrated Windows/IIS workload or the migrated Ubuntu/Apache workload, keeping all user-controlled resources in the same lab resource group.
+
+> [!NOTE]
+> Screenshots throughout the Hack illustrate portal workflows and may show older resource names. The lab dashboard's subscription, resource group, host name, and credentials are authoritative. For manual deployments, use the equivalent details provided securely by your instructor wherever a challenge refers to the dashboard. Do not create separate source and destination resource groups or delete the lab resource group during Challenges 2–8.
 
 The Hyper-V discovery and migration design is described here:
 
@@ -76,8 +81,12 @@ Complete these prerequisites before the session:
 
 * A Microsoft Entra ID tenant.
 * At least one Azure subscription.
-* A Microsoft Entra user with Contributor or Owner permissions on the Azure subscription.
+* A Microsoft Entra learner account with **Owner on the Hack subscription**, assigned by Hackbox Console or the manual organizer, so additional resource providers can be registered during the exercises. RG Owner with subscription Reader is not sufficient when providers are not preregistered. Instructors arrange quota and separately approve/enable any optional Defender plans.
 * A client network and browser that support the Azure portal, Azure Bastion, and Azure Cloud Shell.
+* A ready lab deployment and connection details from Hackbox Console or the instructor. Instructors should follow the [deployment instructions](resources/README.md) before the session; fresh predeployment can take 35–90+ minutes.
+
+> [!WARNING]
+> Subscription Owner also permits modifying other learners' resource groups and shared subscription settings. Work only in your assigned lab RG and follow the instructor's approval and cost guidance; separate RGs do not provide security isolation with this role.
 
 Challenge 7 assumes Hack participants have Azure Copilot access, suitable RBAC, network access, and a supported region. It also includes a concise manual/KQL fallback if agent output is unavailable. No Azure OpenAI resource, model deployment, or model quota is required anywhere in this Hack.
 

03-Azure/01-03-Infrastructure/06_Migration_Secure_AI_Ready/challenges/challenge-01.md

@@ -7,18 +7,20 @@
 
 ## Goal
 
-- Deploy a *source* resource group with two VMs and their dependencies that act as on-premises Hyper-V workloads to be migrated to Azure.
-- Deploy a *destination* resource group to which the servers will be migrated.
+- Understand the preprovisioned single-resource-group lab, its source and destination networks, and the four nested Hyper-V VMs.
+- Receive your platform dashboard connection details and verify that the lab is ready.
 
 ## Actions
 
-- Deploy the [Bicep configuration](../resources) for the Hack.
+- Open the platform dashboard and record your assigned subscription, `<YOUR-LAB-RESOURCE-GROUP>`, Hyper-V host name, and login credential fields.
+- Connect through Azure Bastion, verify the host readiness status and four running nested VMs, and open both web dashboards.
+- Leave discovery, migration, monitoring, and App Service configuration for the later challenges. Instructors handle [predeployment](../resources/README.md).
 
 ## Success criteria
 
 - You have understood the concept and architecture for the Hack.
-- The Bicep deployment command exits successfully.
-- The *source* and *destination* resource groups are visible in the Azure Portal.
+- Your one assigned resource group contains the source VNet (`10.1.0.0/16`), destination VNet (`10.2.0.0/16`), NAT Gateways, Bastion access, Key Vault, and the Hyper-V host named in your dashboard (for example, `mh-0013-hv` in a fresh `rg-labuser-0013` lab).
+- At initial handoff, the host VM's tags are `DeploymentProgress=Deployment Completed` and `LabReady=single-rg-v1`, the schema-version-1 marker `C:\MHBox\lab-ready.json` is present, and all four nested VMs are running.
 - The Windows/IIS and Ubuntu/Apache demo dashboards return HTTP success and show the correct hostname, platform, and web server.
 
 ## Learning resources

03-Azure/01-03-Infrastructure/06_Migration_Secure_AI_Ready/challenges/challenge-06.md

@@ -6,11 +6,19 @@
 
 The goal of this exercise is to ...
 
-* secure the migrated virtual machines by enabling Defender for Cloud for Servers.
+* verify and use Defender for Cloud for Servers protection on the migrated virtual machines in your lab resource group.
+
+## Prerequisites
+
+* Learners have **Owner on the Hack subscription**. Subscription-wide plan changes affect every learner, so do not change shared settings without instructor approval.
+* The instructor has confirmed that the shared subscription's Defender CSPM and Defender for Servers plans are enabled and has approved their costs.
+
+> [!NOTE]
+> In the hosted environment, Defender plans are likely already enabled on the shared subscription through Azure Policy enforcement. Verify the current status of both required plans before requesting activation; do not disable or downgrade policy-managed plans.
 
 ## Actions
 
-* Enable Defender for Cloud.
+* Check the existing Defender plans first. If a required plan is missing, ask the instructor to confirm policy enforcement or approve activation. Then inspect endpoint protection and review alerts and recommendations for your lab resources.
 
 ## Success criteria