How to Add or Remove Locks From an Azure Resource?

Pre-requisite: Azure

In this article, we will learn “How to Add or Remove Locks from an Azure Resource?” Users can only add or remove locks from resources when they have permission to manage. To perform this add or remove lock operation on Azure Resources, users should have the following RBAC roles “Owner” or “User Access Administrator”.

Types of Locks in Azure

In Azure, there are two types of locks that can be applied to resources:

• Read-Only Locks: As the name suggests, read-only locks make a resource read-only, meaning that it cannot be deleted or modified until the lock is removed. This type of lock is useful when you want to ensure that critical resources remain in a consistent state and are not accidentally changed or deleted.
• Delete Locks: Delete locks prevent a resource from being deleted, but allow for modifications to be made. This type of lock is useful when you want to prevent a resource from being deleted accidentally, while still allowing for updates or modifications to be made.

Steps to Add Lock from Azure Portal

Step 1: Log in to the Azure Portal.

Step 2: Navigate to the Azure resource to which you wish to add a resource lock.

Step 3: After selecting the resource >> Select “Locks” from the menu settings on the left. 

Point to be noted the process is same for all the azure resources such as subscription, resource group and any other resource in azure.

Step 4: Click on the “+ Add” button to create a new lock.

Step 5: Give the Name of the Lock ‘ReadOnlyLock‘ or ‘CanNotDeleteLock‘ of your choice you wish to add

• Lock Type: Delete for ‘CanNotDelete’  or ReadOnly for ‘ReadOnlyLock’
• Add Notes if you wish to add the reason and then Click on OK.

This is how you can add  ‘ReadOnlyLock’ or ‘CanNotDelete’ on Azure resource/resources.

Steps to Remove Lock from Azure Portal

Step 1: Go to the Azure Portal

Step 2: Navigate to the Azure resource which has a lock and you wish to remove

Step 3: After selecting the azure resource >> Select “Locks” from the menu settings on the left. 

Point to be noted the process is same for all the azure resources such as subscription, resource group and any other resource in azure.
. 

Step 4: Select the lock you want to remove and click the “Delete” button. If you wish the edit and modify the lock click on “Edit”

Once the lock is/are removed or deleted then you will see a response such as “This resource has no locks”

Note: Removing a lock from a resource does not delete the resource, it just removes the lock from it.

Steps to Add Resource Locks on Azure via PowerShell

Step 1: Go to the Azure Portal

Step 2: Select the Azure Cloud Shell and switch to PowerShell Terminal

Step 3: Create a new PowerShell file using the following run command.

touch addRGLock.ps1

Step 4: To write the code in newly file, use the below command

code addRGLock.ps1

Step 5: Now copy and paste the below PowerShell cmdlet to add the lock on a resource, specifying the lock name, lock level, and resource name at force using asking the confirmation.

New-AzResourceLock 
-LockName "<add name of the lock>" `
-LockLevel "<CanNotDelete or ReadOnly>" `
-ResourceGroupName "<add resource group name>" `
-ResourceName "<add resource name>" `
-ResourceType "<add resource type>" -Force

If it’s only a resource group then use the following PowerShell cmdlet to add the lock, specifying the lock name, lock level and resource group name at force.

New-AzResourceLock `
-LockName "<add name of the lock>" `
-LockLevel "<CanNotDelete or ReadOnly>" `
-ResourceGroupName "<add resource group name>" -Force

Step 6: Run the following run command to execute the addRGLock.ps1 file

Steps to Delete Resource Locks on Azure via PowerShell

Step 1: Go to the Azure Portal

Step 2: Select the Azure Cloud Shell and switch to PowerShell Terminal

Step 3: Create a new PowerShell file using the following run command.

touch deleteRGLock.ps1

Step 4: To write the code in newly file, use the below command

code deleteRGLock.ps1

Step 5: Now copy and paste the below PowerShell cmdlet to delete the lock on a resource, specifying the lock name, resource group name, and resource name at force.

Remove-AzResourceLock `
-LockName "<add name of the lock>" `
-ResourceGroupName "<add resource group name>" `
-ResourceName "<add resource name>" -Force

If it’s only a resource group then use the following PowerShell cmdlet to delete the lock, specifying the lock name and resource group name at force.

Remove-AzResourceLock `
-LockName "<add name of the lock>" `
-ResourceGroupName "<add resource group name>" -Force

Step 6: Run the following run command to execute the deleteRGLock.ps1 file.

./deleteRGLock.ps1