Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Removing CanNotDelete Lock to Delete Storage
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An administrator needs to decommission and delete an unused Azure storage account. When attempting to delete the resource in the Azure portal, the operation fails because a CanNotDelete resource lock is currently applied to the storage account.
What action must the administrator take to successfully delete the storage account?
Explanations
Assign the Owner role in Azure RBAC to the administrator account to bypass the lock.
Assign the Owner role in Azure RBAC to the administrator account to bypass the lock.
What Azure RBAC Roles Do
Azure Role-Based Access Control (Azure RBAC) is an authorization system used to grant fine-grained permissions to security principals (users, groups, and service principals) over Azure resources.
Why It Doesn't Meet the Requirement
Resource locks take precedence over RBAC permissions. Even a user with the Owner or User Access Administrator role cannot delete or modify a locked resource while the lock is active. While an Owner has permission to remove the lock, having the Owner role alone does not automatically bypass the lock's enforcement.
Key Characteristics and Limitations
- Independent Safeguard: Resource locks apply to all users and administrators regardless of their assigned RBAC permissions.
- Management Permissions: Users must possess appropriate RBAC permissions (such as
Microsoft.Authorization/locks/*) to create or remove locks. - No Bypass Mechanism: There is no built-in RBAC flag or superuser role that ignores an active resource lock during a delete request.
This Answer Would Be Correct If
This option would be appropriate if the administrator lacked the authorization permissions needed to manage and remove resource locks in the subscription.
Apply a resource tag named Decommission to override the lock setting.
Apply a resource tag named Decommission to override the lock setting.
What Resource Tags Do
Resource tags are metadata key-value pairs applied to Azure resources and resource groups to assist with logical categorization, cost tracking, environment identification, and asset management.
Why It Doesn't Meet the Requirement
Resource tags are informational metadata and do not provide functional governance controls or security overrides. Adding, modifying, or removing a tag cannot override, disable, or supersede a Resource Lock.
Key Characteristics and Limitations
- Metadata Only: Tags store contextual data such as department names, cost centers, or lifecycle stages.
- No Policy or Lock Override: Tags cannot alter Azure Resource Manager validation rules or bypass operational restrictions.
- Affected by Locks: If a ReadOnly lock is in place, users cannot even modify or add tags because tagging is a resource update operation.
This Answer Would Be Correct If
This option would be correct if the organization required adding metadata to mark resources for upcoming review or inventory audits prior to manual decommissioning.
Change the existing resource lock level from CanNotDelete to ReadOnly.
Change the existing resource lock level from CanNotDelete to ReadOnly.
What the ReadOnly Lock Is
A ReadOnly lock is a stricter type of resource lock that prevents both configuration modifications and deletions on the target resource while permitting read operations.
Why It Doesn't Meet the Requirement
Changing the lock level to ReadOnly does not permit deletion. In fact, a ReadOnly lock continues to block all delete operations while additionally restricting updates and management writes, making the deletion still impossible.
Key Characteristics and Limitations
- Blocks Deletions: Like CanNotDelete, a ReadOnly lock prevents deletion of the resource.
- Blocks Updates: It restricts write actions such as modifying settings, updating SKU tiers, or changing network configurations.
- Affects Management Operations: It can prevent operations that require POST requests (such as listing storage account keys).
This Answer Would Be Correct If
This option would be correct if the administrator wanted to prevent other team members from modifying the configuration settings of the storage account while still keeping it active.
Remove the resource lock from the storage account before attempting the deletion.
Remove the resource lock from the storage account before attempting the deletion.
What Resource Lock Management Is
Azure Resource Manager locks provide a mechanism to protect critical Azure resources from accidental deletion or unintended configuration changes. When a lock is active on a resource, it restricts specific management plane operations regardless of the user's role-based access control (Azure RBAC) permissions.
How It Solves the Requirement
To delete a resource that is protected by a lock:
- An authorized administrator must first explicitly delete or remove the resource lock.
- Once the lock is removed using tools like the Azure portal, Azure PowerShell (
Remove-AzResourceLock), or the Azure CLI (az lock delete), the deletion restriction is lifted. - The administrator can then proceed to delete the storage account normally.
Key Capabilities and Best Practices
- Explicit Protection: Locks enforce a two-step deletion process, requiring administrators to consciously remove the lock before destroying a resource.
- Management Tools: Existing locks can be viewed with
Get-AzResourceLockand removed usingRemove-AzResourceLockor the portal Locks pane. - Documentation: Adding descriptive Notes when creating locks helps team members understand why a lock exists and who to contact before removing it.
- Scope Hierarchy: Removing a lock at the resource level resolves resource-specific locks, but inherited locks from a parent Resource Group or Subscription must be removed at their respective parent scope.
Why This Is Optimal
Removing the lock is the only supported method to permit deletion of a locked resource. It ensures that safeguards cannot be bypassed accidentally and enforces operational intent.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Lock Types
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Lock CannotDelete
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Owner Role vs CanNotDelete Resource Lock
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Group
Describe Azure resources and resource groups
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated