Resource Locks

Resource locks are used to prevent resources from being modified. More importantly, they are used to prevent resources from being accidentally deleted, as locks override any permissions that have been set through RBAC.

Resource locks are managed at the subscription, resource group, and resource level and can be one of the following types:

• Read-only lock: Admins cannot delete or update a resource
• CanNotDelete lock: Admins can update but cannot delete a resource

Unlike resource tags, resource locks are “inherited” by child resources. This means that all the resources in that scope will inherit a parent scope lock. You can add both Read-only and Cannotdelete lock types to resources; multiple locks could be applied to a resource, with the most restrictive inherited lock applying and taking precedence. Figure 8.2 aims to visualize the levels at which locks can be applied and inherited:

Figure 8.2 – Azure resource...