CannotDelete Locks Allow Updates Without Deletion Risk

What a CannotDelete Resource Lock Is

An Azure Resource Manager resource lock with the CannotDelete (or CanNotDelete) level is a governance mechanism that prevents authorized users from accidentally or intentionally deleting an Azure resource, while still allowing them to read and modify its settings.

How It Meets the Requirements

• Prevents Accidental Deletion: Applying a CannotDelete lock creates an explicit restriction at the Azure Resource Manager control plane that blocks all delete operations on the storage account.
• Permits Configuration Changes: Unlike stricter lock types, CannotDelete allows administrators and authorized engineers to continue modifying account configurations, updating network rules, and performing standard maintenance.
• Applies Across All Permission Levels: Resource locks apply to all users, even those assigned high-privilege built-in roles such as Owner or Contributor, ensuring that a careless command or misclick cannot destroy critical infrastructure.

Key Advantages and Capabilities

• Targeted Protection: Can be applied at the subscription, resource group, or individual resource scope.
• Independent of Role Assignments: Restricts deletion actions without requiring custom RBAC role configurations.
• Inheritance Support: Child resources automatically inherit locks configured on parent scopes such as resource groups.
• Quick Override Workflow: If an administrator genuinely needs to delete the resource, they must first explicitly remove the lock, adding a crucial safeguard step.

Why This Is Optimal

A CannotDelete lock is the optimal choice because it precisely satisfies both business requirements: blocking destructive deletion actions while enabling normal administrative updates without disrupting operational workflows.