📖 What is Azure Resource Locks?
Azure Resource Locks are settings applied to resources or resource groups to prevent accidental deletion or modification. There are two types of locks: 'CanNotDelete' and 'ReadOnly', which provide an essential layer of protection for critical production infrastructure.
"Be careful: a 'ReadOnly' lock prevents both deletion AND modification, while 'CanNotDelete' only prevents the resource from being removed."
📚 Certification: Microsoft Azure Fundamentals (AZ-900)
🔑 What are the Key Concepts of Azure Resource Locks?
- ▸ Locks applied at the subscription or resource group level are inherited by all child resources, ensuring consistent protection across a specific scope.
- ▸ The 'CanNotDelete' lock allows users to read and modify resources but prevents them from being accidentally deleted from the Azure environment.
- ▸ The 'ReadOnly' lock is more restrictive, preventing both the deletion of the resource and any modifications to its current configuration settings.
- ▸ Managing locks requires specific Azure RBAC permissions, typically held by the Owner or User Access Administrator roles to prevent unauthorized lock removal.
🎯 How does Azure Resource Locks appear on the AZ-900 Exam?
You may be asked to identify the correct lock type for a scenario where a company needs to prevent a production database from being deleted, but still wants administrators to be able to update its configuration settings.
A scenario might describe a requirement to protect an entire suite of critical resources from any changes or deletions; you should identify that applying a lock at the resource group level is the most efficient approach.
Expect questions asking you to distinguish between RBAC permissions and resource locks in a case where a user with the 'Owner' role is unexpectedly blocked from deleting a specific resource in the portal.
❓ Frequently Asked Questions
How do resource locks differ from Azure RBAC?
RBAC manages 'who' has permission to perform specific actions based on their role, whereas resource locks manage 'if' an action can be performed at all, acting as a safety guard regardless of the user's assigned permissions.
Can a user with the Owner role bypass a ReadOnly lock?
No, even a user with full Owner permissions cannot modify or delete a locked resource. The lock must be explicitly removed by a privileged user before any restricted modifications or deletions can be performed.