CanNotDelete Lock Allows Updates and Blocks Deletion

What the Contributor Role Is

The Contributor role is a built-in Azure RBAC role that allows a user or security principal to create and manage all types of Azure resources within a scope, but does not grant the ability to manage access permissions to other users.

Why It Does Not Meet the Requirement

The Contributor role grants full permission to delete resources. Assigning or maintaining the Contributor role alone does not protect the storage account from accidental deletion by the administrator or automated scripts.

Key Characteristics and Limitations

• Full Management Permissions: Includes create, read, update, and delete (*/write and */delete) capabilities for resources.
• Lacks Deletion Protection: Provides no safeguard against accidental resource deletion.
• Access Management Boundary: Cannot grant or revoke RBAC role assignments to other identities.

This Answer Would Be Correct If

Assigning the Contributor role would be correct if the objective was to grant a developer or team full operational control over resources within a resource group, without needing deletion prevention safeguards.

What the Reader Role Is

The Reader role is a built-in Azure Role-Based Access Control (Azure RBAC) role that grants permissions to view existing resources across a specified scope without granting permissions to make changes or deletions.

Why It Does Not Meet the Requirement

Assigning the Reader role does not fulfill the stated requirements for two reasons:

1. It prevents users from updating configuration settings, which the scenario explicitly requires.
2. It does not prevent other users who hold Contributor or Owner roles from deleting the storage account.

Key Characteristics and Limitations

• Read-Only RBAC Scope: Allows users to inspect resource metadata and settings.
• No Modification Rights: Users cannot edit properties, modify networking rules, or manage data services.
• Not a Resource Lock: RBAC roles define individual user access permissions rather than applying an absolute lock to the resource itself.

This Answer Would Be Correct If

Assigning the Reader role would be correct if the objective was to give an auditor or observer view-only access to inspect the storage account without granting any editing rights.

What the ReadOnly Lock Is

A ReadOnly lock is an Azure Resource Manager lock type that restricts a resource so that authorized users can read its state and configuration, but cannot delete it or update any of its configuration properties.

Why It Does Not Meet the Requirement

Applying a ReadOnly lock prevents administrators from modifying the storage account configuration. The scenario specifically requires administrators to update settings as needs change. Under a ReadOnly lock, all update, write, and HTTP POST management actions (such as regenerating keys or altering network access rules) are blocked.

Key Characteristics and Limitations

• Prevents All Updates: Disallows any configuration changes or property updates to the target resource.
• Blocks Management Operations: Restricts control plane actions such as listing storage account keys via the Azure Resource Manager API.
• Restricts Deletion: Like the CanNotDelete lock, it also prevents the resource from being deleted.

This Answer Would Be Correct If

A ReadOnly lock would be the appropriate choice if the resource configuration were strictly finalized and no team members were permitted to make modifications, updates, or configuration changes.