Resource locks and tags — what they block and their limits
What CanNotDelete and ReadOnly locks really block (control plane only; ReadOnly also blocks POST actions such as storage listKeys, VM start and App Service plan scaling), inheritance, who can manage locks, how a lock blocks resource-group deletion and deployment-history cleanup, the Bicep lock resource — and tag rules (50 per resource, name and value lengths, case behaviour).
markdownreferencev1PE1M-CEFMstage: referencetrust: officialservice: arminterface: cliinterface: iacresource lockCanNotDeleteReadOnly locklock blocks listKeysReadOnly lock VM startlock inheritanceMicrosoft.Authorization/locksaz lock createaz lock listaz lock deletelock resource group deletionscope is lockedtags limit 50tag name 512 characterstag value 256 characterstags case-insensitiveaz tag update
Resource locks and tags
Locks
A lock overrides every role, Owner included, but only for control-plane operations. Data inside a locked storage account or database can still be changed or deleted.
| Lock | Blocks |
|---|---|
CanNotDelete (portal: Delete) | Deleting the resource. Reads and updates still work |
ReadOnly (portal: Read-only) | Updates and deletes, like everyone having Reader, and every POST action |
ReadOnly breaks things that don't look like writes, because they're POST requests:
- Listing storage account keys: tools that fetch keys, including some portal blades, fail.
- Creating a blob container through the control plane.
- Starting or restarting a VM in a locked resource group.
- Scaling an App Service plan in a locked resource group.
- Creating an NSG flow log for a locked NSG.
Before you add a ReadOnly lock, list the POST actions your automation uses on those resources.
Inheritance and side effects:
- A lock applies to everything below its scope, including resources added later; the most restrictive lock wins.
- Extension resources (diagnostic settings) inherit the lock of the resource they're on.
- A
CanNotDeletelock on one resource blocks deleting its whole resource group: no partial deletion. - A lock on the group stops Resource Manager pruning deployment history, which leads to
DeploymentQuotaExceededat 800 deployments. - Locks don't block subscription cancellation.
Managing locks needs Microsoft.Authorization/locks/* (Owner, User Access Administrator; Contributor can't remove a lock):
az lock create --name keep --lock-type CanNotDelete --resource-group rg-prod
az lock list --resource-group rg-prod -o table
az lock delete --name keep --resource-group rg-prodresource keep 'Microsoft.Authorization/locks@2020-05-01' = {
name: 'keep'
properties: {
level: 'CanNotDelete'
notes: 'Production data: delete through change control.'
}
}Deployed in a resource-group file, this locks the group. Set scope: <resource symbol> to lock one resource.
Tags
- At most 50 name–value pairs per resource, resource group or subscription. Put a JSON string in one value if you need more.
- Tag name up to 512 characters (128 for storage accounts); value up to 256.
- Names are case-insensitive for operations (the provider may keep your casing); values are case-sensitive.
- Tags don't flow from a resource group to its resources unless a policy (
modifyor inherit-tag policies) does it. - Some resource types restrict when tags can be updated (VM extensions only while the VM runs).
az tag update --resource-id <id> --operation Merge --tags env=prod owner=team-ordersMerge adds the given tags and overwrites their values; Replace replaces the whole set; Delete removes the given ones. (az tag create also replaces all tags.)