Removing CanNotDelete Lock to Delete Storage

What Resource Lock Management Is

Azure Resource Manager locks provide a mechanism to protect critical Azure resources from accidental deletion or unintended configuration changes. When a lock is active on a resource, it restricts specific management plane operations regardless of the user's role-based access control (Azure RBAC) permissions.

How It Solves the Requirement

To delete a resource that is protected by a lock:

• An authorized administrator must first explicitly delete or remove the resource lock.
• Once the lock is removed using tools like the Azure portal, Azure PowerShell (Remove-AzResourceLock), or the Azure CLI (az lock delete), the deletion restriction is lifted.
• The administrator can then proceed to delete the storage account normally.

Key Capabilities and Best Practices

• Explicit Protection: Locks enforce a two-step deletion process, requiring administrators to consciously remove the lock before destroying a resource.
• Management Tools: Existing locks can be viewed with Get-AzResourceLock and removed using Remove-AzResourceLock or the portal Locks pane.
• Documentation: Adding descriptive Notes when creating locks helps team members understand why a lock exists and who to contact before removing it.
• Scope Hierarchy: Removing a lock at the resource level resolves resource-specific locks, but inherited locks from a parent Resource Group or Subscription must be removed at their respective parent scope.

Why This Is Optimal

Removing the lock is the only supported method to permit deletion of a locked resource. It ensures that safeguards cannot be bypassed accidentally and enforces operational intent.