1. Home
  2. Training Library
  3. Microsoft Azure
  4. Courses
  5. Managing Azure Subscriptions and Resource Groups

Resource Locks

Start course


As an IT professional tasked with managing resources in Azure, it’s important to understand key administrative roles and permissions within a subscription and within a resource group. It’s also important to know how to leverage Role Based Access Control (RBAC) for managing such administrative roles and permissions.

In the first part of this course, you will learn about Azure subscriptions.  You will learn about key roles within a subscription, including the owner role, account administrator role, service administrator role, and the co-administrator role.  You’ll also learn how to manage these roles by using RBAC. We’ll also cover subscription policies and the role they play in the management of an Azure subscription.

In the second part of the course, we’ll talk about resource groups in Azure.  We’ll touch on what they do and how they are managed. You will learn how to secure resources within a resource group via resource policies and resource locks.  You’ll also learn about resource tagging and how it can be used to manage and group Azure resources.

Rounding out this course, we’ll cover the process of moving resources from one resource group to another, as well as the deletion of resource groups altogether.

Learning Objectives

Azure Subscriptions

  • Understand the Owner Role
  • Understand the Account Administrator Role
  • Understand the Co-Administrator Role
  • Understand the Service Administrator Role
  • How to Manage Roles and Permissions with RBAC
  • Understand Subscription Policies

Resource Groups

  • Understanding the Purpose of Resource Groups
  • How to Leverage Resource Group Policies
  • How to Use Resource Locks to Protect Resources
  • How to Leverage Resource Tags  
  • Moving Resources Between Resource Groups
  • Removing Resource Groups

Intended Audience

  • IT Professionals interested in becoming Azure cloud architects
  • IT Professionals preparing for Microsoft’s Azure certification exams


  • General knowledge of IT infrastructure
  • General knowledge of the Azure environment


Day-to-day administration will sometime require you to lock a subscription, resource group, or specific resource to prevent other users from accidentally deleting or modifying critical resources. When this need arises, you can set resource locks. By setting lock levels to CanNotDelete or to ReadOnly, you can ensure resources are not deleted or modified. In the Azure portal, the locks are called Delete and Read-only respectively. The CanNotDelete lock allows authorized users to read and modify a resource, but not delete the resource. ReadOnly allows authorized users to read a resource, but not delete or update the resource. Applying the ReadOnly lock is similar to restricting all authorized users to the permissions granted by their Reader role. When a lock is applied at a parent scope, all resources within that scope inherit the lock. Resources added later will also inherit the lock from the parent. 

The most restrictive lock in the inheritance takes precedence. It's important to note that applying ReadOnly can sometimes lead to unexpected results, because some operations that appear to be read operations, are actually operations that require additional actions. For example, a ReadOnly lock on a storage account will prevent all users from listing the keys. This is because the list keys operation is handled through a POST request because the keys returned are available for write operations. Similarly, placing a ReadOnly lock on an app service resource will prevent Visual Studio Server Explorer from displaying files for the resource, because displaying files requires write access. To create or delete management locks, you must have access to Microsoft.Authorization/*, or Microsoft.Authorization/locks/*actions. Only the built-in Owner and User Access Administrator roles are granted these actions.

About the Author
Learning paths8

Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.

In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.

In his spare time, Tom enjoys camping, fishing, and playing poker.