Resource locks
Resource locks are used to prevent resources from being modified, but more importantly, they are used to prevent resources from being accidentally deleted; locks override any permissions that have been set through RBAC.
Resource locks are managed at the subscription, resource group, and resource level and can be one of the following types:
- Read-only lock: Admins cannot delete or update a resource.
- CanNotDelete lock: Admins can update a resource but not delete one.
Unlike resource tags, resource locks are inherited by child resources. This means that all the resources in that scope will inherit a parent scope lock. You can add both lock types to resources; multiple locks could be applied to a resource, with the most restrictive inherited lock applying and taking precedence. The following diagram aims to visualize the levels that locks can be applied and inherited at:
Figure 9.2 – Azure resource locks
Resource locks...
