---
cuppy_hub: azure
cuppy_path: reference/arm/locks-and-tags.md
cuppy_section: docs
cuppy_doc: PE1M-CEFM
cuppy_doc_uuid: e033ddc7-0447-408e-a42c-ffe23569fa56
cuppy_permalink: https://cuppy.io/azure/d/PE1M-CEFM
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/arm/locks-and-tags
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: a7ba73a4259437641acb1c405a38bb3e1de01916ba7a75e438406aadaa8b2e73
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Resource locks and tags

## Locks

**A lock overrides every role, Owner included, but only for control-plane operations.** Data inside a locked storage account or database can still be changed or deleted.

| Lock | Blocks |
|---|---|
| `CanNotDelete` (portal: Delete) | Deleting the resource. Reads and updates still work |
| `ReadOnly` (portal: Read-only) | Updates and deletes, like everyone having Reader, **and every POST action** |

**`ReadOnly` breaks things that don't look like writes**, because they're POST requests:

- Listing storage account keys: tools that fetch keys, including some portal blades, fail.
- Creating a blob container through the control plane.
- Starting or restarting a VM in a locked resource group.
- Scaling an App Service plan in a locked resource group.
- Creating an NSG flow log for a locked NSG.

Before you add a `ReadOnly` lock, list the POST actions your automation uses on those resources.

**Inheritance and side effects:**

- A lock applies to everything below its scope, including resources added later; the most restrictive lock wins.
- Extension resources (diagnostic settings) inherit the lock of the resource they're on.
- A `CanNotDelete` lock on **one** resource blocks deleting its **whole resource group**: no partial deletion.
- A lock on the group stops Resource Manager pruning **deployment history**, which leads to `DeploymentQuotaExceeded` at 800 deployments.
- Locks don't block subscription cancellation.

**Managing locks** needs `Microsoft.Authorization/locks/*` (Owner, User Access Administrator; Contributor can't remove a lock):

```
az lock create --name keep --lock-type CanNotDelete --resource-group rg-prod
az lock list --resource-group rg-prod -o table
az lock delete --name keep --resource-group rg-prod
```

```bicep
resource keep 'Microsoft.Authorization/locks@2020-05-01' = {
  name: 'keep'
  properties: {
    level: 'CanNotDelete'
    notes: 'Production data: delete through change control.'
  }
}
```

Deployed in a resource-group file, this locks the group. Set `scope: <resource symbol>` to lock one resource.

## Tags

- At most **50** name–value pairs per resource, resource group or subscription. Put a JSON string in one value if you need more.
- Tag name up to **512** characters (**128** for storage accounts); value up to **256**.
- Names are **case-insensitive** for operations (the provider may keep your casing); values are **case-sensitive**.
- Tags don't flow from a resource group to its resources unless a policy (`modify` or inherit-tag policies) does it.
- Some resource types restrict when tags can be updated (VM extensions only while the VM runs).

```
az tag update --resource-id <id> --operation Merge --tags env=prod owner=team-orders
```

`Merge` adds the given tags and overwrites their values; `Replace` replaces the whole set; `Delete` removes the given ones. (`az tag create` also replaces all tags.)


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->