An Azure resource lock is a protection setting that helps prevent unwanted changes to a resource or scope. Azure supports two common lock types: CanNotDelete, which blocks deletion, and ReadOnly, which blocks most write operations. Locks are often applied to critical resources such as storage accounts, resource groups, or subscriptions to reduce accidental damage and slow destructive actions.
In cyber security, resource locks matter because attackers who gain a valid Azure identity may try to delete systems, disable recovery options, or change settings from the management plane. A lock can raise the cost of that abuse by stopping straightforward deletion or modification, even when the attacker has some permissions. However, locks are not a complete defense: they do not replace least-privilege RBAC, identity monitoring, or strong credential hygiene, and they can be bypassed if the attacker can remove the lock or operate at a higher scope.