An administrator assigns a team member the **Owner** role on a production Azure resource group. To safeguard against accidental data loss, the administrator also applies a **CanNotDelete** (Delete) resource lock directly to a critical Azure Storage account inside that resource group. How does the resource lock affect the operations that the user can perform on this storage account?

The user can read and modify the storage account configuration, but cannot delete the storage account without first removing the lock.: ### What a CanNotDelete Resource Lock Is An Azure **CanNotDelete** resource lock (often labeled as a **Delete** lock in the Azure portal) is a governance mechanism designed to prevent unauthorized or accidental deletion of critical cloud assets. When placed on a resource, such as a **Storage account**, it creates an explicit management barrier that blocks all deletion operations while allowing standard operational activities to continue uninterrupted. ### How It Meets the Scenario Requirements - **Preserves Configuration Access**: The **CanNotDelete** lock permits authorized administrators and services to read settings, update configurations, and deploy updates to the resource. - **Restricts Deletion Requests**: Any attempt to execute a delete action against the storage account is rejected at the **Azure Resource Manager** control plane level. - **Overrides RBAC Privileges**: Even though the user possesses the **Owner** role with full control permissions, resource locks take precedence over role assignments. The user must explicitly remove or delete the lock before deleting the storage account. ### Key Advantages and Capabilities - **Accident Prevention**: Protects high-value infrastructure from human error during routine clean-up or command-line script execution. - **Independent Enforcement**: Enforces restrictions universally across the **Azure portal**, **Azure CLI**, **Azure PowerShell**, and REST APIs. - **Granular Control**: Allows daily management and feature updates without exposing the resource to destructive deletion. - **Clear Audit Trail**: Lock removal actions are logged in the **Azure Activity Log**, maintaining visibility and accountability. ### Why This Is Optimal Combining **Role-Based Access Control (RBAC)** with a **CanNotDelete** resource lock ensures the user can fulfill day-to-day administrative duties without risking catastrophic, unintended downtime or resource destruction.

Resource Lock Cannotdelete Operation Impact | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!

StudyCerts

Resource Lock Cannotdelete Operation Impact | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification! | StudyCerts

AZ-900 Microsoft Azure Fundamentals Exam

Related questions