SOLVED

MS Learn Sandbox - Unauthorized Sandbox use detected. Your sandbox has been terminated

%3CLINGO-SUB%20id%3D%22lingo-sub-1867433%22%20slang%3D%22en-US%22%3EMS%20Learn%20Sandbox%20-%20Unauthorized%20Sandbox%20use%20detected.%20Your%20sandbox%20has%20been%20terminated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1867433%22%20slang%3D%22en-US%22%3E%3CP%3EI%20get%20blocked%20access%20to%20Sandbox%20resources%20in%20following%20learning%20example%3A%3CBR%20%2F%3E%3CSTRONG%3E%22Monitor%20the%20health%20of%20your%20Azure%20virtual%20machine%20by%20using%20Azure%20Metrics%20Explorer%20and%20metric%20alerts%22%2C%3C%2FSTRONG%3E%3CBR%20%2F%3Edirect%20link%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Flearn%2Fmodules%2Fmonitor-azure-vm-using-diagnostic-data%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Flearn%2Fmodules%2Fmonitor-azure-vm-using-diagnostic-data%2F%3C%2FA%3E%3CBR%20%2F%3EI%20can%20believe%20that%20command%20sequence%20in%20unit%208%20which%20should%20stress%20VM%20CPU%2C%20cause%20issue%3A%3CBR%20%2F%3E%3CSTRONG%3Esudo%20stress%20--cpu%2016%20-v%20-t%2010m%3CBR%20%2F%3E%3C%2FSTRONG%3EDirectly%20after%20execution%20of%20the%20sequence%20my%20access%20to%20Sandbox%20resources%20was%20blocked%2C%20I%20sent%20appeal%20as%20requested.%20As%20well%20I%20sent%20feedback%20-%20content%20of%20the%20online%20course%20must%20be%20reviewed%2C%20and%20instructions%3CBR%20%2F%3Eto%20stop%20the%20CPU%20stress%20sequence%20added%2C%20before%20user%20leave%20Azure%20CLI%20session%20or%20move%20to%20next%20example.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20image-alt%3D%222020-11-09%2016_10_16-Window.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F232507i52A34FE739F9353E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222020-11-09%2016_10_16-Window.jpg%22%20alt%3D%222020-11-09%2016_10_16-Window.jpg%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1867433%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESandbox%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1877056%22%20slang%3D%22en-US%22%3ERe%3A%20MS%20Learn%20Sandbox%20-%20Unauthorized%20Sandbox%20use%20detected.%20Your%20sandbox%20has%20been%20terminated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1877056%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616812%22%20target%3D%22_blank%22%3E%40Dimitri-K%3C%2FA%3E%26nbsp%3BThanks%20for%20noting%20that%2C%20I'll%20let%20the%20content%20team%20responsible%20for%20that%20module%20know.%20They%20will%20certainly%20trip%20up%20the%20fraud%20detection%20with%20that%20statement!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1879438%22%20slang%3D%22en-US%22%3ERe%3A%20MS%20Learn%20Sandbox%20-%20Unauthorized%20Sandbox%20use%20detected.%20Your%20sandbox%20has%20been%20terminated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1879438%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%20Mark%3CBR%20%2F%3E%3CBR%20%2F%3EThank%20you%20for%20your%20reply%20and%20support%20actions.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20would%20like%20to%20add%20more%20technical%20details%20-%20I%20receive%202%20alert%20Emails%20from%20this%3CBR%20%2F%3Elearning%20example%2C%20so%20advised%20VM%20CPU%20stress%20sequence%20did%20right%20job.%3CBR%20%2F%3EHowever%2C%20timeout%2010%20minutes%20was%20long%20enough%20to%20rise%20alarm%20of%20Sandbox%20misuse.%3CBR%20%2F%3EMoreover%2C%20in%20next%20example%2C%20unit%204%2C%20similar%20sequence%20%22%3CSTRONG%3E-%20sudo%20stress%20--cpu%201%3C%2FSTRONG%3E%22%20in%20use%2C%3CBR%20%2F%3Ewithout%20timeout%2C%20direct%20link%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Flearn%2Fmodules%2Fincident-response-with-alerting-on-azure%2F4-exercise-metric-alerts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Flearn%2Fmodules%2Fincident-response-with-alerting-on-azure%2F4-exercise-metric-alerts%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EThat%20exact%20entry%20point%20of%20the%20Sandbox%20request%20where%20I%20face%20block%20message%3CBR%20%2F%3Eafter%20execution%20of%20the%20previous%20example.%3CBR%20%2F%3EWill%20wait%20until%20my%20appeal%20is%20reviewed%20by%20appropriate%20support%20team%20and%3CBR%20%2F%3Econtinue%20my%20journey.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EDimitri%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1880801%22%20slang%3D%22en-US%22%3ERe%3A%20MS%20Learn%20Sandbox%20-%20Unauthorized%20Sandbox%20use%20detected.%20Your%20sandbox%20has%20been%20terminated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1880801%22%20slang%3D%22en-US%22%3EDM%20me%20your%20MSA%20used%20and%20I'll%20check%20on%20the%20appeal.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1883632%22%20slang%3D%22en-US%22%3ERe%3A%20MS%20Learn%20Sandbox%20-%20Unauthorized%20Sandbox%20use%20detected.%20Your%20sandbox%20has%20been%20terminated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1883632%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3EWould%20like%20to%20finalize%20this%20post%20with%20positive%20feedback%20-%20my%20appeal%20was%20reviewed%20and%3CBR%20%2F%3Eaccess%20to%20Sandbox%20resources%20restored.%20I%20was%20able%20to%20complete%20my%20module%20without%3CBR%20%2F%3Etechnical%20issues%20or%20errors.%3CBR%20%2F%3E%3CBR%20%2F%3EThanks.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EDimitri%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I get blocked access to Sandbox resources in following learning example:
"Monitor the health of your Azure virtual machine by using Azure Metrics Explorer and metric alerts",
direct link:
https://docs.microsoft.com/en-us/learn/modules/monitor-azure-vm-using-diagnostic-data/
I can believe that command sequence in unit 8 which should stress VM CPU, cause issue:
sudo stress --cpu 16 -v -t 10m
Directly after execution of the sequence my access to Sandbox resources was blocked, I sent appeal as requested. As well I sent feedback - content of the online course must be reviewed, and instructions
to stop the CPU stress sequence added, before user leave Azure CLI session or move to next example.

2020-11-09 16_10_16-Window.jpg

4 Replies
best response confirmed by Dimitri-K (Occasional Contributor)
Solution

@Dimitri-K Thanks for noting that, I'll let the content team responsible for that module know. They will certainly trip up the fraud detection with that statement!

Hello, Mark

Thank you for your reply and support actions.

I would like to add more technical details - I receive 2 alert Emails from this
learning example, so advised VM CPU stress sequence did right job.
However, requested by command sequence 16 workers and timeout 10 minutes
was enough to trigger alarm of Sandbox misuse.
Moreover, in next example, unit 4, similar sequence "- sudo stress --cpu 1" in use,
without timeout, direct link:
https://docs.microsoft.com/en-us/learn/modules/incident-response-with-alerting-on-azure/4-exercise-m...

That exact entry point of the Sandbox request where I face block message
after execution of the previous example.
Will wait until my appeal is reviewed by appropriate support team and
continue my journey.

Regards,
Dimitri

DM me your MSA used and I'll check on the appeal.

Hi,

Would like to finalize this post with positive feedback - my appeal was reviewed and
access to Sandbox resources restored. I was able to complete my module without
technical issues or errors.

Thanks.

Regards,
Dimitri