Use Locks to Protect your Azure Resources
Tags: resourcelocks, azureresources, accidentaldeletion, modifications
Published: 2023-06-26 12:05:02

Resource locks are Azure tools for protecting your resources from unauthorised or accidental modifications and deletion. Locks can be used to protect Azure Subscription, Resource groups and individual resources. When a lock is applied on any of the aforementioned, it supersede any permission or authorisation the User may have.

There are two types of Locks in Azure. On the Azure portal, these locks are called Delete and Read-only. In the command line, they are called CanNotDelete and ReadOnly.

**CanNotDelete** means authorized users can read and modify a resource, but they can not delete it.
**ReadOnly** means authorized users can read a resource, but they can not delete or update it. 

It is also worthy of note that when lock is applied at a parent level, for example, on a resource group, all resources within that group will inherit the lock. Even when a resource is added to a resource group that has a CanNotDelete lock, after the lock has been applied to the group, the new resource will inherit the group lock. Locks protect a resource from changes, but they do not restrict how a resource performs its functions.

In this blog we will show how to manage resource locks in Azure. We  will also show the effect of locks on resources. I will create a resource group and add a resource to it. A Resource lock will be added to the Resource group. We will test the lock by trying to delete the resource from the group. Then we will remove the lock and try to delete the resource again.  

Come on! Lets start.

Log in to Azure Portal and select Resource group


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ojpni4cpk2hq01fcsofb.png)


Click on Create 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8wb8jx3qs6iml51qljp5.png)






Complete the Project details. My subscription is Azure Pass Sponsorship. I will name the Resource group **UniRg** and select East US as the Region


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n3izhfhqiufzk9vbnk8s.png)


Click on Tags and create one for the Resource group. The Name:Value pair will be **Yemmy Oye: Procurement**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ndnu6e4sou3s0k2664g3.png)






Click on Review and Create


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ddmjp294du0kx95tm650.png)






When validation is passed, click on create

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/prk6frm7n7p58ew5hp6k.png)

The Resource group UniRg has been created

Go back to Azure portal and add resource to the Resource group. Here, I want to add a Storage account.
On azure portal, select Storage account

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wlkpvuyxuf3wt668xtom.png)





Click on create and complete the Project details. My subscription is Azure Pass Sponsorship. Select the Resource group UniRg created earlier

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ftw0tcbfrllb107xgm1.png)

Complete the Instance details. I will name the storage account **yemistore**. Remember that the name must be in lower case.I will leave other details at default.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zr3nldo44f7sfw4zvsts.png)






Click on Review

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rqd7ibu1a00ueslm9699.png)




Click on Create and wait for the deployment to complete


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/766iqtwza90m7pxb6d13.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dhptkq25o5fw5qzpo8d.png)


Go to Resource

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3x7ygcb5nstx6zcn0j9q.png)







The Storage account yemistore has been created



Go back the Resource group UniRg and click on Locks

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5bdb9heublwl55m1zb8p.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hvrnmze1nbduf5ckfcre.png)



Then click Add

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pvb8yflaem9xjx4sp64j.png)




I will name the Lock **neverdelete** and select **Delete** as the Lock type
A note is also added stating that: 
"this will protect the resources in  this group from unauthorised deletion"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ylrl0jdyu7s89ka22r2v.png)

Click OK

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rla8rhsh533ct4750bvq.png)



The Lock **neverdelete** has been applied to the Resource group UniRg. All resources in this group inherits the lock.

Come on! Lets test this out.

Go back to the Overview page of the Resource group UniRg and click on the Storage account named yemistore

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ik0o9xm3ik2mdcki094y.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bf202thazeoo6ufjq3j6.png)





To test the lock applied to the Resource group UniRg that contain the storage account yemistore, we will try to delete the storage account and observe what happens.

Click on Delete

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0dmvplsgd785exzvg8gv.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1vnfusrvgh4fomzujz2v.png)




You can see from the above image that the Resource **yemistore** can not be deleted because it has inherited the Lock **neverdelete** applied to its parent **UniRg**

Lets try to remove the Lock on UniRg and observe what happens next
Go to the Resource group and click on Locks
Then click on the Delete button on the right hand side of the Lock, **neverdelete**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/216njnj075nrhb7jxo4r.png)





The Lock on the Resource group has been deleted

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lse1a6zt4rbfs5g8rcy7.png)



Now, go back and try to delete the storage account again

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d5zw03h1wy9y0saw705o.png)
Specify the Storage account name to be deleted


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sy2h9y3m10is6ein2s75.png)
Then Click Delete


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3bjxu9ng5o0cgvziuhqq.png)
Confirm delete

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/crsdjt3i5h9vh9vlknco.png)





The Storage account yemistore has been successfully deleted because the Lock on its parent has been removed.

Great!! Isn't it?

That is an amazing tool on Microsoft Azure for securing your resources.

Your feedbacks will be appreciated.