An Azure resource lock can help prevent accidental deletion of important infrastructure.
Choose the correct lock
- Delete: Allows changes but prevents resource deletion.
- Read-only: Blocks changes as well as deletion and can disrupt normal operations.
For deletion protection, choose Delete.
Add the lock
- Sign in to the Azure portal.
- Open the resource or resource group.
- Under Settings, select Locks.
- Select Add.
- Enter a descriptive name, such as
protect-production-storage. - Choose Delete as the lock type.
- Add a note identifying the owner and removal procedure.
- Save the lock.
Resource-group locks apply to the resources within that group. Review the scope before applying one.
Verify and maintain protection
Confirm the lock appears in the Locks list. Test deletion prevention only on a disposable test resource.
Users need appropriate lock-management permissions to create or remove locks. Document who may remove production locks.
Understand the limitations
Locks protect Azure management operations, not every operation on stored data. A storage-account lock does not prevent deletion of blobs through the data plane.
Locks can also interfere with automated cleanup, scaling, and backup operations. Review the service-specific limitations before deployment.
