An IT administrator is managing a critical storage account named `corpdata` in a resource group named `rg-production`. The team must be able to continue updating the storage account's configuration and accessing data, but the organization wants to prevent any user from accidentally deleting the storage account. Which Azure PowerShell command should the administrator execute to apply the appropriate resource lock?

New-AzResourceLock -LockName "LockStorage" -LockLevel CanNotDelete -ResourceGroupName "rg-production" -ResourceName "corpdata" -ResourceType "Microsoft.Storage/storageAccounts": ### What the Solution Is The `New-AzResourceLock` cmdlet creates an **Azure Resource Manager lock** on a designated Azure resource, resource group, or subscription. Azure supports two resource lock levels: **CanNotDelete** and **ReadOnly**. ### How It Meets the Requirements - **Prevents Accidental Deletion**: Specifying `-LockLevel CanNotDelete` ensures that authorized users can read and modify the resource's configuration while strictly blocking any operation that deletes the resource. - **Permits Configuration Updates**: Unlike a ReadOnly lock, the **CanNotDelete** level allows administrators and developers to continue modifying settings and updating properties on the `corpdata` storage account without encountering authorization errors. - **Targets the Specific Resource**: By providing `-ResourceName "corpdata"` along with `-ResourceType "Microsoft.Storage/storageAccounts"`, the lock is scoped directly to the storage account rather than locking every item in the parent resource group. ### Key Advantages and Capabilities - **Overrides RBAC Permissions**: Resource locks enforce protection across all users, including those assigned the **Owner** or **Contributor** role, preventing accidental deletion until the lock is explicitly removed. - **Fine-Grained Scoping**: Locks can be applied at the subscription, resource group, or individual resource scope depending on business governance requirements. - **Scriptable and Repeatable**: Using Azure PowerShell cmdlets allows administrators to automate guardrails across critical infrastructure deployments. ### Why This Is Optimal This command precisely implements a **CanNotDelete** lock on the specific storage account, satisfying both constraints: safeguarding the resource against deletion while permitting normal day-to-day administrative changes.

Azure Powershell Apply Cannotdelete Resource Lock | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!

StudyCerts

Azure Powershell Apply Cannotdelete Resource Lock | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification! | StudyCerts

AZ-900 Microsoft Azure Fundamentals Exam

Related questions