Governance
CoreAzure resource locks
Control-plane protection against deletion or modification.
Key points
- CanNotDelete blocks control-plane deletion while allowing permitted modifications.
- ReadOnly blocks control-plane modification and deletion.
- Locks inherit to descendants and apply even when the caller otherwise has RBAC permission.
Best-known use cases
- Protect a critical database from accidental deletion.
- Freeze control-plane changes during a sensitive period.
What candidates often confuse it with
- Lock vs RBAC: extra mutation protection vs actor authorization.
- CanNotDelete vs ReadOnly: block deletion only vs block update and deletion.
Key takeaway
Use a resource lock as deliberate control-plane protection, never as a substitute for authorization or data protection.
Related services
- Azure Policy
- Microsoft Cost Management
- Azure Advisor
Relevant exam tasks
- D1.3.S1 — Implement and manage Azure Policy
- D1.3.S2 — Configure resource locks
- D1.3.S6 — Manage costs by using alerts, budgets, and Azure Advisor recommendations