Azure resource locks: CanNotDelete vs ReadOnly

Even people with the right permissions make mistakes, such as deleting the wrong resource group. A resource lock protects a subscription, resource group or resource from accidental deletion or modification, and it overrides user permissions.

Key behaviour:

• Applies to everyone, including Owners. Unlike RBAC, a lock restricts all users and roles. To change or delete a locked resource, first remove the lock, then perform the action you have permission for.
• Inherited: a lock on a parent scope applies to all resources within it, including resources added later. The most restrictive lock in the chain wins.
• Scopes: subscription, resource group or resource. Locks can’t be applied to management groups.
• Who can manage locks: users with Microsoft.Authorization/locks/* permissions, such as Owner and User Access Administrator.
• Control plane only: locks protect the resource itself, not the data inside it. A ReadOnly lock on a database server still allows data in its databases to be changed, and a lock on a storage account doesn’t stop blobs being deleted through the data plane.
• All or nothing: if any resource in a resource group has a Delete lock, deleting the resource group fails entirely; there is no partial deletion.
• Side effects of ReadOnly: some operations that look harmless need write (POST) access. A ReadOnly lock on a storage account stops users listing its access keys; on a resource group containing a VM it stops the VM being started or restarted; on a subscription it stops Azure Advisor working properly.
• Locks are managed in the portal (Locks on a resource or resource group, Resource locks on a subscription), Azure PowerShell, Azure CLI, ARM templates or Bicep, and the REST API.

One-line CLI example: az lock create --name LockGroup --lock-type CanNotDelete --resource-group rg-app

Common trap: Believing an Owner can delete a resource that has a Delete lock - locks apply regardless of RBAC role; even an Owner must remove the lock first.

Common trap: Relying on a lock to protect the data stored in a resource - locks apply only to control-plane (management) operations; data-plane operations such as deleting blobs or database rows are not blocked.

Get the whole book

This note is one section of Ultra Transcenders AZ-900: Microsoft Azure Fundamentals, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · AZ-900 terms in the glossary · All AZ-900 study notes