Frequently Asked Questions

Access & Registration

1. Who can access the ACX Lab?

The ACX Lab is available to all Microsoft full-time employees (FTEs) with a valid @microsoft.com email address. Vendors and partners can request access but require manager approval and are evaluated case-by-case.

2. How long does registration take?

End-to-end registration typically takes 15–30 minutes. Email verification is instant, Entra and AD account creation take 5–15 minutes, and RBAC propagation can take up to 15 minutes. See Registration for the full process.

3. I registered but can't see any resources in the Azure portal. What's wrong?

Most likely one of two things:

Wrong directory: You need to switch to the ACX Lab tenant in the Azure portal. Click your profile icon → Switch directory → select ACX Lab.
RBAC propagation delay: After registration, RBAC assignments can take up to 15 minutes to propagate. Wait and refresh.

See Can't Log In for more details.

4. I lost my on-prem AD password. How do I reset it?

AD credentials are sent once during registration and are not retrievable afterward. Contact the ACX Lab team in the ACX Lab Teams channel to request a password reset. You'll need to verify your identity.

5. Can I use my @ntdev.microsoft.com or alias email?

No. The registration portal only accepts primary @microsoft.com email addresses. Aliases and @ntdev addresses are not supported for registration.

Resources & VMs

6. What VM sizes are available?

The following sizes are allowed: D2s_v3 (2 vCPU/8 GB), D4s_v3 (4 vCPU/16 GB), D8s_v3 (8 vCPU/32 GB), A4_v2 (4 vCPU/8 GB), NC8_A2 (8 vCPU + A2 GPU), NC16_A16 (16 vCPU + A16 GPU). See Allowed Resources for the full list.

7. How do I create a VM?

Use the Azure portal's Automation Account runbooks or the ACX Lab Power App. Go to Automation Accounts → ACX-Automation → Runbooks → select a Deploy runbook (e.g., Deploy-SmallVM). See Request Resources for step-by-step instructions.

8. How long do my resources last?

All resources have a 90-day default lifespan. You'll receive email notifications at 14 days and 7 days before expiry. Resources are automatically deleted 7 days after expiration. You can extend resources by updating the expires tag. See Data Retention.

9. Are my VMs backed up?

No. Lab VMs do not have automatic backups. If your VM or its disk is deleted, the data is gone. Save important work to Git, Azure Storage, or OneDrive. See Data Retention for recommendations.

10. Can I deploy GPU workloads?

Yes. Request the ACX Lab - GPU Workloads access package through My Access (requires manager approval). GPU VM sizes available are NC8_A2 (NVIDIA A2) and NC16_A16 (NVIDIA A16). GPU capacity is limited, so availability is not guaranteed.

Connectivity

11. How do I connect to my VM?

Use the Azure Virtual Desktop (AVD) session as your supported access path. From the AVD desktop, open the Azure portal or your local remote tools and connect to the VM using its private IP or name. See Connecting to Resources.

12. Do I need a VPN?

No. VPN is not offered for standard ACX Lab access. Use the AVD desktop for your lab session and connect to resources from there. See Connecting to Resources.

13. How do I use kubectl with AKS Arc?

Install the Azure CLI connectedk8s extension, log in with az login --tenant <ACX-Lab-Tenant-ID>, then run az connectedk8s proxy -n <cluster-name> -g <resource-group>. In a separate terminal, use kubectl as normal. Remember to target your assigned namespace. See Connecting to Resources.

14. Why does Arc Run Command time out?

Arc Run Command has a 120-second timeout. If your kubectl operation takes longer (e.g., pulling large images), use the az connectedk8s proxy method instead. See AKS Permission Denied.

Policies & Costs

15. Does the ACX Lab cost my team anything?

No. The ACX Lab is centrally funded. There is no chargeback to individual teams. However, resources are shared, so please be a good neighbor — deallocate VMs when not in use and clean up resources you no longer need.

16. What regions can I deploy to?

Resources must be deployed to eastus, westus2, or canadacentral. Other regions are blocked by Azure Policy. The Azure Local clusters are physically located in the Toronto site (Canada Central). See Allowed Resources.

17. What tags are required on my resources?

All resources must have two tags: owner (your Microsoft alias) and expires (expiration date in YYYY-MM-DD format). Resources without these tags are flagged and may be deleted after a 7-day grace period. See Allowed Resources.

18. Can I store customer data or production credentials in the lab?

Absolutely not. The ACX Lab is a non-production environment. Do not store customer data, PII, production credentials, or export-controlled data. See Security Policies for the full list of prohibited data types.

Troubleshooting

19. My registration is stuck. What do I do?

Check the status page to identify which step is stuck. Common fixes: check your Junk folder for verification/invitation emails, wait for RBAC propagation (up to 15 min), or re-register (the system is idempotent). See Registration Stuck for detailed steps.

20. I get "permission denied" in AKS. What's wrong?

You're likely targeting the wrong namespace. Use your assigned namespace (kubectl -n user-youralias get pods) instead of the default namespace. If you just registered, RBAC propagation can take up to 15 minutes. See AKS Permission Denied.

Automation & Copilot

21. Is there an MCP server for Copilot integration?

Yes. The ACX Lab provides an MCP (Model Context Protocol) server that enables Copilot-driven operations. You can use GitHub Copilot to interact with lab resources — provision VMs, check status, manage namespaces, and more — without leaving your IDE or terminal. Contact the ACX Lab team for MCP endpoint details.

22. Can I check my status programmatically?

Yes. Use the status API endpoint:

curl "https://acx-guest-onboarding-api.azurewebsites.net/api/status/check?email=youralias@microsoft.com"

This returns a JSON response with the state of each provisioning step. See Check Registration Status.

23. What is the ACX Lab tenant ID?

The ACX Lab runs on the adaptivecloudlab.com tenant. Use this when logging in with az login --tenant adaptivecloudlab.com or switching directories in the Azure portal.