Applying CanNotDelete Lock to a Storage Account

What the Solution Is

The New-AzResourceLock cmdlet creates an Azure Resource Manager lock on a designated Azure resource, resource group, or subscription. Azure supports two resource lock levels: CanNotDelete and ReadOnly.

How It Meets the Requirements

• Prevents Accidental Deletion: Specifying -LockLevel CanNotDelete ensures that authorized users can read and modify the resource's configuration while strictly blocking any operation that deletes the resource.
• Permits Configuration Updates: Unlike a ReadOnly lock, the CanNotDelete level allows administrators and developers to continue modifying settings and updating properties on the corpdata storage account without encountering authorization errors.
• Targets the Specific Resource: By providing -ResourceName "corpdata" along with -ResourceType "Microsoft.Storage/storageAccounts", the lock is scoped directly to the storage account rather than locking every item in the parent resource group.

Key Advantages and Capabilities

• Overrides RBAC Permissions: Resource locks enforce protection across all users, including those assigned the Owner or Contributor role, preventing accidental deletion until the lock is explicitly removed.
• Fine-Grained Scoping: Locks can be applied at the subscription, resource group, or individual resource scope depending on business governance requirements.
• Scriptable and Repeatable: Using Azure PowerShell cmdlets allows administrators to automate guardrails across critical infrastructure deployments.

Why This Is Optimal

This command precisely implements a CanNotDelete lock on the specific storage account, satisfying both constraints: safeguarding the resource against deletion while permitting normal day-to-day administrative changes.