Configuring resource locks
You can apply locks to a subscription, resource group, or resource to prevent other administrators from modifying or deleting resources. You can set lock levels to CanNotDelete or ReadOnly to override permissions that users have, even for administrators. Of the built-in roles, only Owner and User Access Administrator can create or delete resource locks.
The locks are explained as follows:
- CanNotDelete locks deny authorized users from deleting resources but still allow the ability to read and modify resources.
- ReadOnly locks grant authorized users the read permissions to resources only. This means that they can't add, delete, or modify resources. The effect is similar to the Reader role.
Unlike RBAC, you use management locks to apply a restriction across all users and roles. It is important to note that when applying resource locks the law of inheritance applies, meaning that all resources inherit the lock from the parent scope....
