Course owner checklist ยท Complete before invitations

Prepare the workshop platform

Provide isolated Azure sandboxes, participant repositories, scoped user access, and an approved state approach that works from participant workstations.

OwnerCourse and platform teams Target2 weeks before EvidenceSuccessful dry run

Workshop boundary

Provide a safe Azure sandbox

Subscription

Use a dedicated non-production workshop subscription or an equivalent isolated sandbox. Confirm approved regions, provider registration, quota, budget alerts, and policy constraints.

Team boundaries

Assign one resource group and Terraform state key per participant or team. Publish naming, tagging, cost, and cleanup expectations before the workshop.

Least privilege

Use Entra groups and resource-group-scoped roles where practical. Preconfigure exceptional permissions instead of granting subscription-wide Owner.

Source and access

Prepare repositories and participant identities

  1. 01

    Provision participant repositories

    Provide an organization-owned starter repository for each participant or team. Grant permission to clone, create branches, push commits, and open pull requests. Do not require participants to create organization repositories unless that permission is confirmed.

  2. 02

    Assign participant access

    Use Microsoft Entra groups and resource-group-scoped roles where practical. Confirm each participant can authenticate with Azure CLI and work only within the assigned workshop boundary.

  3. 03

    Provide state access

    If exercises use remote state, grant each participant or team only the data-plane access required for its state container or key. Verify storage routing and DNS from the same network participants will use.

  4. 04

    Publish workshop boundaries

    Give each participant the repository, subscription, resource group, state configuration, approved regions, expected cost, and cleanup responsibility before the workshop.

State and connectivity

Give participants an approved state approach

Backend controls

  • Azure Storage uses Entra authentication and data-plane RBAC.
  • Shared-key and anonymous access are disabled.
  • State keys and authorization boundaries are separated by team.
  • State, plans, credentials, and generated metadata are never committed.

Workstation connectivity

  • The participant network can route to the Blob endpoint.
  • Private DNS resolves the storage account correctly.
  • Firewall and network rules admit participant workstations.
  • terraform init can read, lock, and write state.

Acceptance test

Prove the complete path

  1. 01

    Use a participant-equivalent account

    Clone the supplied repository, create a branch, and open a pull request without relying on course-owner privileges.

  2. 02

    Run and review a plan

    Use the VS Code terminal to authenticate, initialize the backend, validate the configuration, and save a plan without changing Azure. Confirm the participant can interpret the proposed actions.

  3. 03

    Apply and clean up

    Apply the reviewed plan, verify the disposable resource, then run the documented destruction path and confirm that no workshop resources remain.

Participant handoff

Invite participants after the dry run

Send each participant their repository, team, Azure subscription, resource group, support route, and the individual setup checklist.

Open participant setup