CanNotDelete Locks Override Owner Role Deletions

What a CanNotDelete Resource Lock Is

An Azure CanNotDelete resource lock (often labeled as a Delete lock in the Azure portal) is a governance mechanism designed to prevent unauthorized or accidental deletion of critical cloud assets. When placed on a resource, such as a Storage account, it creates an explicit management barrier that blocks all deletion operations while allowing standard operational activities to continue uninterrupted.

How It Meets the Scenario Requirements

• Preserves Configuration Access: The CanNotDelete lock permits authorized administrators and services to read settings, update configurations, and deploy updates to the resource.
• Restricts Deletion Requests: Any attempt to execute a delete action against the storage account is rejected at the Azure Resource Manager control plane level.
• Overrides RBAC Privileges: Even though the user possesses the Owner role with full control permissions, resource locks take precedence over role assignments. The user must explicitly remove or delete the lock before deleting the storage account.

Key Advantages and Capabilities

• Accident Prevention: Protects high-value infrastructure from human error during routine clean-up or command-line script execution.
• Independent Enforcement: Enforces restrictions universally across the Azure portal, Azure CLI, Azure PowerShell, and REST APIs.
• Granular Control: Allows daily management and feature updates without exposing the resource to destructive deletion.
• Clear Audit Trail: Lock removal actions are logged in the Azure Activity Log, maintaining visibility and accountability.

Why This Is Optimal

Combining Role-Based Access Control (RBAC) with a CanNotDelete resource lock ensures the user can fulfill day-to-day administrative duties without risking catastrophic, unintended downtime or resource destruction.