Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
CanNotDelete Locks Override Owner Role Deletions
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An administrator assigns a team member the Owner role on a production Azure resource group. To safeguard against accidental data loss, the administrator also applies a CanNotDelete (Delete) resource lock directly to a critical Azure Storage account inside that resource group.
How does the resource lock affect the operations that the user can perform on this storage account?
Explanations
The user cannot view, modify, or delete the storage account because locks override all read, write, and delete permissions.
The user cannot view, modify, or delete the storage account because locks override all read, write, and delete permissions.
What This Restriction Describes
This description reflects an overestimation of lock behavior, confusing a standard lock with total access denial or a complete administrative block. In Azure governance, locks never block basic read operations or hide resources from view.
Why It Doesn't Meet the Requirement
A CanNotDelete lock only restricts deletion operations; it does not block reading or modifying the resource. Furthermore, even a ReadOnly lock permits authorized users to view settings and read resource configurations. Neither lock type completely strips away read access or blinds users to the existence of the resource.
Key Characteristics and Limitations
- CanNotDelete Scope: Restricts only deletion actions while fully allowing read and update operations.
- ReadOnly Scope: Restricts both deletion and configuration updates, but still allows authorized users to read resource properties.
- Read Preservation: Resource locks never restrict
*/readoperations that are permitted by RBAC role assignments.
This Answer Would Be Correct If
Azure governance tools included a total-isolation lock level that completely blocked all read, write, and delete operations simultaneously, which does not exist in Azure Resource Manager.
The user can read and modify the storage account configuration, but cannot delete the storage account without first removing the lock.
The user can read and modify the storage account configuration, but cannot delete the storage account without first removing the lock.
What a CanNotDelete Resource Lock Is
An Azure CanNotDelete resource lock (often labeled as a Delete lock in the Azure portal) is a governance mechanism designed to prevent unauthorized or accidental deletion of critical cloud assets. When placed on a resource, such as a Storage account, it creates an explicit management barrier that blocks all deletion operations while allowing standard operational activities to continue uninterrupted.
How It Meets the Scenario Requirements
- Preserves Configuration Access: The CanNotDelete lock permits authorized administrators and services to read settings, update configurations, and deploy updates to the resource.
- Restricts Deletion Requests: Any attempt to execute a delete action against the storage account is rejected at the Azure Resource Manager control plane level.
- Overrides RBAC Privileges: Even though the user possesses the Owner role with full control permissions, resource locks take precedence over role assignments. The user must explicitly remove or delete the lock before deleting the storage account.
Key Advantages and Capabilities
- Accident Prevention: Protects high-value infrastructure from human error during routine clean-up or command-line script execution.
- Independent Enforcement: Enforces restrictions universally across the Azure portal, Azure CLI, Azure PowerShell, and REST APIs.
- Granular Control: Allows daily management and feature updates without exposing the resource to destructive deletion.
- Clear Audit Trail: Lock removal actions are logged in the Azure Activity Log, maintaining visibility and accountability.
Why This Is Optimal
Combining Role-Based Access Control (RBAC) with a CanNotDelete resource lock ensures the user can fulfill day-to-day administrative duties without risking catastrophic, unintended downtime or resource destruction.
The user can delete the storage account, but cannot modify any of its configuration settings.
The user can delete the storage account, but cannot modify any of its configuration settings.
What This Option Describes
This option describes an inverted set of restrictions where deletion is allowed while configuration updates are blocked. Azure Resource Manager does not provide a lock type that prevents modification while freely permitting deletion.
Why It Doesn't Meet the Requirement
A CanNotDelete lock specifically forbids deletion while permitting configuration modifications. In contrast, a ReadOnly lock prevents both modifications and deletions. There is no lock configuration in Azure that prohibits modifications while leaving the resource vulnerable to deletion.
Key Characteristics and Limitations
- Inversion of Behavior: Confuses the purpose of CanNotDelete, which protects against resource deletion, with update restrictions.
- ReadOnly Behavior: When update prevention is needed, a ReadOnly lock blocks both updates and deletions simultaneously.
- Management Rule: Deletion is fundamentally considered a destructive modification; therefore, locking against changes never leaves delete open.
This Answer Would Be Correct If
Azure offered a specialized lock type that blocked updates while intentionally allowing deletion, which is counter to Azure's governance and data protection model.
The user can delete the storage account directly because the Owner role in Azure RBAC overrides resource locks.
The user can delete the storage account directly because the Owner role in Azure RBAC overrides resource locks.
What Azure RBAC Roles Do
Azure Role-Based Access Control (Azure RBAC) is an authorization system that grants security principals specific permissions (such as read, write, and delete actions) across management scopes like subscriptions, resource groups, or individual resources. The Owner role grants broad management rights, including full access to manage resources and assign permissions to other users.
Why It Doesn't Meet the Requirement
Resource locks do not yield to Azure RBAC role assignments. In Azure Resource Manager, locks are evaluated before RBAC permissions. Even if a user holds the highest built-in administrative roles—such as Owner or Contributor—a CanNotDelete lock strictly blocks any delete operation until an authorized administrator removes the lock.
Key Characteristics and Limitations
- Universal Enforcement: Locks apply to all users, service principals, and administrators regardless of their assigned RBAC permissions.
- Precedence Hierarchy: Resource locks act as a guardrail on the management plane that supersedes allow permissions defined in RBAC.
- Two-Step Requirement: An Owner who needs to delete a locked resource must first explicitly delete the lock and then proceed with resource deletion.
This Answer Would Be Correct If
A user had the Owner role on a storage account that had no resource locks applied, allowing direct deletion through standard RBAC privileges.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock Removal
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Lock Types
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Lock CannotDelete
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags
Describe the purpose of tags
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated