Security Policies
The ACX Lab follows Microsoft security standards. All users must comply with these policies.
Authentication and Access
Multi-Factor Authentication (MFA)
MFA is required for all ACX Lab access. This includes:
- Azure portal access via Entra guest account
- Any service that authenticates against Azure AD
Entra Conditional Access
The ACX Lab tenant enforces the following Conditional Access policies:
| Policy | Requirement |
|---|---|
| MFA | Required for all users on all devices |
| Compliant device | Required for AVD access |
| Sign-in risk | High-risk sign-ins are blocked |
| Session timeout | Portal sessions expire after 8 hours of inactivity |
On-Premises AD
- AD passwords must meet complexity requirements (12+ characters, mixed case, numbers, symbols)
- AD passwords expire every 90 days
- AD accounts lock after 5 consecutive failed login attempts (auto-unlock after 30 minutes)
Network Security
No Public Endpoints
Lab resources must not have public IP addresses or public-facing endpoints. All access is through:
- Azure Virtual Desktop (AVD) — supported desktop access path for lab users
- Azure Arc proxy — for kubectl access to AKS Arc clusters
Network Segmentation
- Each user's VMs are deployed to isolated subnets
- Network Security Groups (NSGs) restrict traffic between user subnets
- Outbound internet access from VMs is allowed but monitored
- Lab VMs cannot reach Microsoft corporate network resources directly
Data Security
Prohibited Data Types
Do not store the following in the ACX Lab:
| Prohibited | Examples |
|---|---|
| Customer data | Any data from real customers or partners |
| Personal data / PII | Social Security numbers, personal addresses, etc. |
| Production credentials | Production service keys, connection strings, certificates |
| ITAR/EAR controlled data | Export-controlled technical data |
| Highly confidential business data | M&A plans, earnings data, etc. |
Allowed Data
| Allowed | Examples |
|---|---|
| Test/synthetic data | Generated test datasets, sample configs |
| Open-source code | Public repositories, community tools |
| Lab configuration | Deployment scripts, Kubernetes manifests |
| Internal documentation | Lab guides, runbooks, architecture diagrams |
| Non-production secrets | Lab-only API keys, test certificates |
Encryption
- All managed disks are encrypted at rest with platform-managed keys
- Network traffic within the lab uses TLS 1.2+
- Azure Storage accounts enforce HTTPS-only access
Monitoring and Auditing
Activity Monitoring
The following activities are logged and may be audited:
- Azure resource creation, modification, and deletion
- Login attempts (successful and failed)
- Network traffic patterns (flow logs)
- AKS API server audit logs
- Automation runbook executions
Compliance Checks
Automated compliance checks run daily to:
- Identify resources without required tags (
owner,expires) - Detect publicly accessible resources
- Flag VMs with known vulnerable OS versions
- Report on resource usage and quota utilization
Non-compliant resources receive a warning tag. Resources that remain non-compliant for 7 days may be deleted.
Incident Reporting
If you discover a security issue in the lab:
- Do not attempt to exploit or test the vulnerability further
- Report it immediately in the ACX Lab Teams channel or directly to the ACX Lab team
- Include: what you found, how you found it, and any steps to reproduce
User Responsibilities
By using the ACX Lab, you agree to:
- Use the lab only for its intended purpose (testing Azure hybrid/edge technologies)
- Not attempt to access other users' resources without authorization
- Not store prohibited data types in the lab
- Keep your credentials secure and never share them
- Report any security incidents promptly
- Comply with all Microsoft corporate security policies