CanNotDelete Lock Allows Updates and Blocks Deletion

What the CanNotDelete Lock Is

An Azure Resource Manager CanNotDelete lock (also referred to as CannotDelete or Delete) is a governance safeguard applied to subscriptions, resource groups, or individual resources. Its primary purpose is to block deletion operations while still permitting authorized users to read and modify resource configurations.

How It Meets the Requirements

• Allows Configuration Updates: Authorized administrators and services retain full permissions to modify settings, rotate keys, update network rules, and scale the resource as needed.
• Blocks Resource Deletion: Any attempt by a user, script, or automated pipeline to delete the storage account is immediately denied by Azure Resource Manager until an administrator explicitly removes the lock.

Key Advantages and Capabilities

• Overrides RBAC Privileges: Even users with the Owner or Contributor role cannot delete a resource protected by a CanNotDelete lock without first deleting the lock itself.
• Accidental Deletion Protection: Safeguards critical infrastructure from accidental execution of scripts or routine cleanup tasks.
• Inheritance Across Hierarchies: When applied at a parent resource group or subscription scope, all child resources automatically inherit the deletion protection.
• Auditable Lifecycle: Adding and removing locks generates audit events in Azure Activity Logs for security tracking.

Why This Is Optimal

A CanNotDelete lock is the optimal choice because it precisely satisfies the requirement to prevent deletion while maintaining the administrative ability to change and update the storage account configuration.