We provision an account an account per lab machine, with a name/password that's basically public, then build a Conditional Access policy that ensures those cred

We provision an account an account per lab machine, with a name/password that's basically public, then build a Conditional Access policy that ensures those credentials can only be used from that machine.