Skip to content
CAMPUX Cloud Bootcamp The Workbench · Hands-On Labs Contents →
The Workbench
Free · your own subscription
CLI · Bicep · Terraform · torn down
Hands-On Labs

Reading is not doing.

Real builds in your own Azure subscription, driven by the CLI and infrastructure-as-code, verified at every step — then torn down before the bill notices. Mapped to what the jobs actually ask for. Free to start, no account needed — every lab ends in a teardown to $0, so you will not get billed. New here? Begin with L01.

On sequencing: the beginner labs (L01–L02) need no prior classes. After those, each lab assumes the class it came from — if one leans on identity, networking, or Kubernetes you have not met yet, read the mapped classes first (every lab names its class, e.g. the AKS lab maps to Class 27). The Start-here path orders the classes and labs together so you do not hit a wall.

The labs

15 live · full role coverage
L01
First Bicep deploy →
A storage account as code — a what-if preview, then the idempotent re-deploy that makes infrastructure-as-code finally click.
StorageBicep Beginner~25 min$0 free-tier what-if + re-deploy is no-op
A good first lab — no class needed first.
L02
Resource Locks →
Protect a resource group with a CanNotDelete lock, prove it blocks a real delete, then remove it and watch the same command succeed.
Resource ManagerCLI Beginner~20 min$0 free-tier delete blocked, then allowed
A good first lab — no class needed first.
L03
RBAC & Managed Identity →
An App Service reads a Key Vault secret through a managed identity and a least-privilege role — zero credentials anywhere in the code.
App ServiceKey VaultEntra IDBicep Intermediate~35 min$0 free-tier secret resolves via MSI
Recommended first: Class 8 · Class 9
L04
App Registration & OIDC SSO →
Register an app in Microsoft Entra ID and wire single sign-on — staff sign in with Microsoft, not one line of auth code written.
Entra IDApp ServiceCLI Intermediate~40 min$0 free-tier browser sign-in succeeds
Recommended first: Class 7 · Class 9
L05
RBAC with Security Groups →
Assign a role once to an Entra security group and manage access at scale through membership — the pattern real teams actually run.
Entra IDRBACCLI Intermediate~30 min$0 free-tier access follows membership
Recommended first: Class 7 · Class 8
L06
Azure Policy as code →
Author a custom policy that denies public-blob storage, watch it block a bad resource, then ship it as code with Bicep.
Azure PolicyStorageBicep Advanced~40 min$0 free-tier non-compliant deploy denied
Recommended first: Class 8
L07
Terraform landing zone + remote state →
Provision a landing zone with Terraform, then migrate state to a locked backend in Azure Storage — plan, apply, and the state lease that makes it team-safe. The IaC tool every posting names.
StorageResource ManagerTerraform Intermediate~40 min$0 free-tier concurrent apply lock-refused
Recommended first: Class 21
L08
GitHub Actions + OIDC — zero stored secrets →
Federate GitHub Actions to Entra ID so a workflow deploys to Azure with no stored secret — short-lived tokens, a scoped role, and an app registration with zero credentials. Exactly as jobs 1–3 describe.
Entra IDApp RegistrationGitHub Actions Intermediate~40 min$0 free-tier deploy runs, 0 secrets stored
Recommended first: Class 22 · Class 23
L09
Hub-and-spoke networking & segmentation →
A hub, two isolated spokes, VNet peering and NSGs that enforce least-privilege connectivity between workloads — the landing-zone network backbone, proven from the routing, with no VMs to bill.
Virtual NetworkNSGCLI Intermediate~35 min$0 no VMs spokes non-transitively isolated
Recommended first: Class 10 · Class 14
L20
Deploy Campux Retail — the storefront behind a private network →
The capstone deploy, guided command by command: a VNet with dedicated subnets, the Campux Retail container on VNet-integrated App Service, a private Azure SQL reached over a private endpoint, and an Application Gateway with WAF as the only public door. The hands-on build of Capstone Plate I.
App ServiceApp Gateway + WAFPrivate EndpointCLI Advanced~75 mintorn down at end store served via WAF · database private
Recommended first: Class 11 · Class 13 · Class 14
L10
Observability: Log Analytics & a KQL alert →
Stream the Activity log into a Log Analytics workspace, query it in KQL, and fire a scheduled-query alert through an action group — the monitoring loop every posting lists, on free-tier ingestion.
Azure MonitorLog AnalyticsKQL Intermediate~35 min$0 free-tier KQL returns · alert enabled
Recommended first: Class 28 · Class 29
L11
Build & govern an MCP server on Azure →
Ship a Model Context Protocol server to Container Apps over streamable HTTP, connect a client that lists and calls its tool, then govern both sides — a managed identity for secret-free outbound, Entra ID built-in auth that 401s anonymous callers. The differentiator skill in senior 2026 postings.
Container AppsEntra IDManaged IdentityPython Advanced~50 min~$0 scale-to-zero client calls tool · anon gets 401
Recommended first: Class 27 · Class 33
L12
Grounded RAG on Azure AI Search →
Embed documents with Azure OpenAI, store and search them as vectors in a free-tier AI Search index, and return grounded answers with citations — then prove the hard part: it refuses to answer what isn't in the source data. RAG exactly as job 3 spells it out.
AI SearchAzure OpenAIEmbeddingsPython Advanced~50 min$0 free tier + pennies cited answer · refuses off-corpus
Recommended first: Class 33
L13
Container Apps + ACR: managed-identity pull, scale-to-zero →
Run a container on Azure Container Apps, pulling the image from ACR with a managed identity (admin account disabled) and scaling to zero when idle — the container pattern most workloads want, without the AKS bill.
Container AppsACRManaged IdentityCLI Intermediate~35 min~$0 scale-to-zero app 200 · min-replicas 0 · no admin creds
Recommended first: Class 26 · Class 27
L14
Cost guardrails: budgets, Advisor & lifecycle →
Set a Cost Management budget with an 80% email alert, read Azure Advisor right-sizing recommendations, and apply a storage lifecycle policy that tiers and expires blobs automatically — cost optimization as controls you deploy.
Cost ManagementAdvisorStorageCLI Beginner~30 min$0 guardrails budget set · lifecycle tiers + expires
Recommended first: Class 32
L15
App Service Environment, read as code →
A concept lab you read, not run: understand the single-tenant, VNet-isolated App Service Environment v3 by reading its four-resource Bicep — delegated subnet, ASEv3 stamp, Isolated v2 plan, private app — and compiling it offline. An ASE bills even when empty, so you learn the architecture and the cost model for $0, and when a private endpoint on a normal Web App is the cheaper right answer.
App Service EnvironmentVNetBicep Intermediate~25 min read$0 read-only bicep build compiles · nothing deployed
Recommended first: Class 11 · Class 20
L16
Back up & restore a file share →
Create a Recovery Services vault, protect an Azure Files share with a backup policy, take a recovery point, then delete a file and restore it from the vault — the full backup-and-restore loop, on the cheapest workload that still teaches it.
Recovery Services vaultAzure FilesCLI Beginner~30 min~$0.25 · tear down deleted file restored from vault
Recommended first: Class 12
L17
Your first AKS cluster: deploy, heal, expose, tear down →
Create a one-node AKS cluster on the free control-plane tier, connect kubectl, deploy an app, then delete a running pod and watch the reconciliation loop bring it back — the moment Kubernetes finally clicks — before tearing it all down. The beginner on-ramp to the Class 27 AKS track.
AKSkubectlDeploymentsCLI Beginner~35 min~$0.30 · free control plane · tear down pod deleted · self-healed · app served
Recommended first: Class 26 · Class 27
L18
Your first GitHub Actions workflow: build, break, fix, inspect →
Create a GitHub Actions workflow that checks out the repository, runs a small test, creates a build output, and uploads it as an artifact. Break the test on purpose, read the failure, fix it, then inspect the saved artifact. Browser only; no Azure deployment or paid runner is required for the exercise.
GitHub ActionsArtifactsYAML Beginner~25 min$0 · browser only checkout removed → fails · restored → passes
Recommended first: Class 39b
L19
GitHub Actions OIDC: deploy with narrow Azure access →
Configure GitHub Actions to exchange a short-lived OIDC token for Azure access, scope the identity to one resource group, and verify that a deployment aimed at a second group is denied.
GitHub ActionsOIDCAzure RBACCLI Intermediate~30 min~$0 · tear down rg-a tagged · rg-b AuthorizationFailed
Recommended first: Class 39i
L21
AKS memory limits & autoscaling: OOMKill, contain, HPA →
Deploy a pod with no memory limit and a deliberate leak, watch it run unopposed because nothing was set to stop it, set requests and limits and watch the identical leak get killed on its own instead, then add a HorizontalPodAutoscaler and drive real load to watch replicas grow and shrink.
AKSkubectlHPACLI Beginner~25 min~$0.20 · tear down leak OOMKilled & contained · replicas scale up & down
Recommended first: Class 27b
L22
AKS least privilege: Role, RoleBinding & can-i impersonation →
Create a namespaced Role and RoleBinding, use kubectl auth can-i with --as impersonation to prove exactly what an identity can and cannot do, deliberately over-grant it to a wildcard and prove the blast radius grows, then narrow it back to least privilege. No second identity needed.
AKSRBACkubectlCLI Beginner~20 min~$0.15 · tear down can-i answers match the Role exactly, before & after
Recommended first: Class 27e
L23
AKS storage that survives a pod: PersistentVolumeClaim on Azure Disk →
Create a PersistentVolumeClaim backed by an Azure Disk, mount it, write a file, delete the pod, and prove the file survives in the replacement — then prove a second pod cannot mount the same ReadWriteOnce claim on another node.
AKSAzure Disk CSIPVCCLI Beginner~20 min~$0.10 · tear down file survives pod delete · RWO blocks a second node
Recommended first: Class 27d
L24
App Service plan & slot swap: deploy, share, swap, prove it →
Put two apps on one App Service plan and confirm they share a single bill, then add a staging slot, deploy a changed page to it, and swap it into production — proving the swap changes content with no restart and no redeploy against the live app.
App ServiceDeployment SlotsCLI Beginner~20 min~$0.10 · tear down production content changes, no restart run
Recommended first: Class 11a · Class 11b
L25
Patch, mount & schedule a VM: the missing auto-start →
Create a small Linux VM, patch it with a run-command, attach and mount a data disk on the stable Azure disk path, schedule it off with auto-shutdown — then hit the trap: auto-shutdown has no auto-start, so you pair it with an Automation runbook and schedule that starts the VM back up, and prove the whole loop by running it.
Virtual MachinesManaged DisksAutomationCLI Beginner~30 min~$0.10 · tear down runbook starts VM · job Completed
Recommended first: Class 11d
L26
AKS ingress & network policy: one door in, then a wall →
Route two Services through one managed NGINX ingress by path and prove it works, then prove any pod can already reach either Service directly with no ingress involved — and apply a NetworkPolicy that closes exactly that gap, while the legitimate ingress route keeps working.
AKSApplication Routing Add-onNetworkPolicyCLI Beginner~25 min~$0.20 · tear down pod-to-pod goes 200 → timeout · ingress route unaffected
Recommended first: Class 27c
L27
AKS Helm release: install, upgrade, roll back →
Install a chart as a named Helm release, watch its revision number, upgrade it with a changed value and watch the rollout land, then roll back to revision one in a single command and prove the change actually reverted — by pod count and by the values Helm stored, not by a green exit code.
AKSHelmCLI Beginner~25 min~$0.05 · tear down 3 pods → 1 pod · helm history shows 3 revisions
Recommended first: Class 27g
Advanced builds — a tier up

Longer, costlier, closer to the real thing

Multi-hour, expert-level builds that run real infrastructure — expect a few dollars of Azure spend, not free tier, and set a budget alert first. Each ends the way the job does: with something you can prove works, then tear down. Do them once you're comfortable with the labs above.

AB1
Zero-Trust on AKS: workload identity, Key Vault & network policy →
Run a workload on AKS with zero static secrets — a Kubernetes ServiceAccount federated to an Azure Managed Identity, reading Key Vault just-in-time — then default-deny the namespace network and prove an unlisted pod is blocked. Zero trust, deployed rather than described.
AKSWorkload IdentityKey VaultNetwork Policy Expert~5–6 hrs~$3–6 real spend pod reads secret, no creds · probe BLOCKED
Recommended first: Class 27 · Class 31
AB2
AKS disaster recovery: Velero, GRS & a cross-region restore →
Back up a stateful AKS workload with Velero to geo-redundant storage, lose the cluster on purpose, restore into a second region, and prove the data is byte-perfect by checksum — then automate the whole drill weekly in GitHub Actions with measured RTO/RPO.
AKSVeleroGRS StorageGitHub Actions Advanced~5–6 hrs~$10–20 real spend checksum matches cross-region · drill green
Recommended first: Class 27 · Class 36
AB3
GitOps on AKS: ArgoCD, Helm & a GitHub Actions sync →
Make the cluster follow Git: install Argo CD, use a Helm chart across dev/QA/prod, observe a failed image and revert it in Git. The optional GitHub Actions OIDC workflow builds an image and records its dev tag; Argo CD reconciles it. Recovery is verified, not assumed automatic.
AKSArgoCDHelmGitHub Actions Advanced~4–5 hrs~$4–8 real spend Git sync · bad image reverted
Recommended first: Class 22 · Class 27
L28
APIM: one catalogue across the gateway →
A supplied OpenAPI contract and coached request traces. Optional Azure steps import the contract, return a mock, and compare separate partner subscriptions. Authentication and private networking have clearly labelled desk checks.
API ManagementDesk or optional Azure mockcontract · observed mock · caller boundaries
Recommended first: Class 38
Build queue — cleared

Every lab off the job descriptions is shipped

The full spine of a modern Azure cloud-engineer role is now live above: IaC in Bicep and Terraform, OIDC pipelines, landing-zone networking, observability, containers, cost, and the AI-platform work — MCP governance and grounded RAG — that senior 2026 postings ask for. New labs still land here as the postings evolve.

New to Azure? Set up your machine first

A one-time, 15-minute setup: a free Azure account, the Azure CLI and Terraform (winget / brew / apt), and az login — then every lab just works. Or skip installs entirely with Azure Cloud Shell.

Start here →
One public repo — clone and go

Each lab is a folder: the step-by-step guide, an IaC template, and any starter code. Open a terminal (or shell.azure.com), clone github.com/kloudcaptain/campux-labs, follow the README.

View the repo →

CostLive labs use free-tier resources and pennies of storage — but the teardown at the end of each is not optional. Confirm the resource group is gone before you close the tab.
AccessIdentity and governance labs create users, groups, and role assignments — run them in a personal test tenant where you are admin, not your employer's subscription, where the guardrails will (correctly) refuse you.