MSDEVBUILD / azure

Resource Locks

AZURE POLICY Rule: only EU regions, tags required West EU✓ Brazil? North EU✓ DENIED
A lock is a safety cap: even an admin can’t delete the resource until the lock is removed.

😟 THE PROBLEM

A clean-up script deletes the production resource group by mistake.

😊 THE SOLUTION

Put Delete or ReadOnly locks on critical resources.

  • Accidental deletion✓ Delete lock blocks it
  • Unwanted changes✓ ReadOnly lock
  • Admins can do anything✓ Locks apply even to Owners
🛠️ Solved with: Resource locks
Try it yourself in the Azure simulator No Azure account needed. Protect resources with locks 🔒 Try it ❯
Module 3: Management & Governance ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Resource locks prevent resources from being accidentally deleted or changed. A Delete lock (CanNotDelete) allows changes but blocks deletion. A ReadOnly lock blocks both changes and deletion. Locks can be applied to subscriptions, resource groups or individual resources, are inherited by child resources, and apply to everyone, even Owners, until the lock is removed.

Exam objective: 3.2.3 Describe the purpose of resource locks. (Skills measured as of July 20, 2026)

Start with a question

What stops a tired admin deleting the production database at 2 a.m.?

A resource lock. Even with full permissions, the delete simply fails.

Explain it like I’m 10

The technical explanation

LockReadModifyDelete
Delete (CanNotDelete)✅✅❌
ReadOnly✅❌❌

Locks override RBAC: even an Owner must remove the lock before deleting or changing a locked resource.

Real-world business scenario

Banking

An online bank

The problem
A clean-up script deleted the wrong resource group, taking down a payment service.
What they used
Delete locks on all production resource groups, with lock removal limited to a small ops group.
Why that choice
Locks block deletion regardless of permissions.
The result
A later scripting mistake was blocked by the lock with no impact.

When to use it and when not to

✓ Use it when…

  • Production and shared resources that must never be deleted by accident.

✕ Think twice when…

  • ReadOnly locks on resources that need normal operations like scaling.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is a resource lock?

Model answer

A safety catch on an Azure resource that stops it from being deleted, or changed, by mistake.

Intermediate What is the difference between Delete and ReadOnly locks?

Model answer

A Delete lock still lets you change the resource but not delete it. A ReadOnly lock stops both changes and deletion, making it effectively read-only.

Experienced developer What surprises can ReadOnly locks cause?

Model answer

Some operations that look like reads are actually writes in Azure Resource Manager. For example, listing storage account keys is a POST, so a ReadOnly lock can block it. A ReadOnly lock on a resource group can also block scaling or creating resources inside it. Test locks before applying them broadly.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which lock prevents deletion but still allows a resource to be modified?

Question 2

Question 2 of 3

A user with the Owner role tries to delete a resource with a ReadOnly lock. What happens?

Question 3

Question 3 of 3

A Delete lock is applied to a resource group. What does it protect?

Quick revision

Key points

  • Locks prevent accidental deletion or modification.
  • Delete (CanNotDelete) vs ReadOnly.
  • Apply at subscription, resource group or resource; inherited downward.
  • Locks apply to all users, including Owners.
  • Remove the lock first to make the change.

Important terminology

Delete lock (CanNotDelete)
Users can read and modify a resource but cannot delete it.
ReadOnly lock
Users can read a resource but cannot modify or delete it.
Lock inheritance
A lock on a resource group or subscription applies to everything inside.

Common mistakes

  • Thinking Owners can bypass locks.

Exam tips

  • "Prevent accidental deletion but allow changes" = Delete (CanNotDelete) lock.

Five quick revision questions

  1. 1.Which lock allows changes but blocks deletion?Show

    Delete (CanNotDelete).

  2. 2.Which lock blocks changes and deletion?Show

    ReadOnly.

  3. 3.Can an Owner delete a locked resource?Show

    Not until the lock is removed.

  4. 4.Are locks inherited?Show

    Yes, by resources within the locked scope.

  5. 5.Where can locks be applied?Show

    Subscriptions, resource groups and resources.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure Portal