How to Prevent Accidental Deletion of Azure Resources with Resource Locks
A company has a production resource group that contains several Azure virtual machines and a SQL database. The company wants to ensure that no user can accidentally delete these resources, but authorized administrators must still be able to modify the configuration and update the resources. The company needs a straightforward governance feature that can be applied directly to the resource group and can be removed only by an authorized user with the Owner role. Which Azure feature should the company use?
Quick Answer
The answer is a Delete lock applied to the resource group. This Azure governance feature is correct because it prevents accidental deletion of Azure resources while still allowing authorized administrators with the Owner role to modify configurations and update the resources. A Delete lock specifically blocks any delete operation on the resource group and all its child resources, yet it does not restrict read or update actions, making it ideal for production environments where configuration changes must continue. On the Microsoft Azure Fundamentals AZ-900 exam, this scenario tests your understanding of Azure Resource Locks as a straightforward governance tool, often appearing as a distractor against role-based access control (RBAC) or Azure Policy—remember that RBAC controls who can act, while locks control what actions are allowed. A common trap is choosing a Read-only lock, which would block all modifications, not just deletions. Memory tip: think of a Delete lock as a “do not delete” sign that only the Owner can remove, keeping your production resources safe from accidental removal.
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy with resource locks, thinking a Deny effect policy is simpler or more appropriate, but Azure Policy is a governance and compliance tool, not a straightforward lock that can be easily toggled by an Owner without policy management overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Delete lock on the resource group.
A Delete lock on the resource group prevents users from deleting the resource group and its resources, while still allowing authorized administrators with the Owner role to modify configurations and update resources. This lock can only be removed by a user with the Owner role, meeting the requirement for a straightforward governance feature applied directly to the resource group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy with a Deny effect to block resource deletions.
Why it's wrong here
Azure Policy with a Deny effect would prevent *all* users, including authorised administrators, from deleting resources, conflicting with the requirement that Owners must still be able to remove the protection and perform deletions intentionally. This feature is designed for enforcing organisational compliance, such as preventing resource creation outside specific regions or blocking the deployment of non-compliant resource types across a subscription, where the intent is to disallow an action universally.
When this WOULD be correct
A company wants to enforce that no one can deploy virtual machines without a specific tag (e.g., 'CostCenter') to ensure cost tracking. Azure Policy with a Deny effect would block any deployment that doesn't include the required tag.
- ✗
A Read-Only lock on the resource group.
Why it's wrong here
A Read-Only lock prevents both modification and deletion. Since the scenario requires that authorized administrators can still update resources, a Read-Only lock would block those updates and is therefore incorrect.
When this WOULD be correct
A company needs to prevent any changes to a critical resource group, including configuration updates, to ensure compliance with a regulatory requirement. Authorized administrators must be able to remove the lock only if they have the Owner role.
- ✓
A Delete lock on the resource group.
Why this is correct
A Delete lock prevents deletion of the resource group and its resources while allowing all other operations, including modifications. This directly addresses the requirement to prevent accidental deletion without hindering updates. Resource locks can be applied at the resource group level and only removed by users with Owner or User Access Administrator roles.
- ✗
An Azure RBAC role assignment that excludes the Delete action for all users.
Why it's wrong here
An RBAC role assignment excluding the Delete action would still allow accidental deletion by any user with a role that includes Delete, unless every role is individually modified—an impractical, fragile approach. It is tempting because RBAC is the standard tool for fine-grained permission control, and in a scenario requiring per-user or per-action exclusions across multiple roles, such an assignment would be the correct choice. However, the scenario demands a single, removable lock on the entire resource group, which only a resource lock provides.
When this WOULD be correct
A question where the requirement is to prevent all users, including administrators, from deleting resources, and the solution must be implemented via granular permission control rather than a resource lock. For example: 'A company wants to ensure that no user, including administrators, can delete a specific storage account, but they still need to modify its configuration. Which feature should they use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Delete lock on the resource group.Correct answer▾
Why this is correct
A Delete lock prevents deletion of the resource group and its resources while allowing all other operations, including modifications. This directly addresses the requirement to prevent accidental deletion without hindering updates. Resource locks can be applied at the resource group level and only removed by users with Owner or User Access Administrator roles.
✗Azure Policy with a Deny effect to block resource deletions.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy with a Deny effect prevents resource creation or modification based on rules, but it does not prevent accidental deletion of existing resources; it is not designed as a lock mechanism and can be bypassed by users with sufficient permissions.
★ When this WOULD be the correct answer
A company wants to enforce that no one can deploy virtual machines without a specific tag (e.g., 'CostCenter') to ensure cost tracking. Azure Policy with a Deny effect would block any deployment that doesn't include the required tag.
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce rules with the lock feature, thinking a Deny effect can block deletions, but locks are specifically designed for that purpose.
✗A Read-Only lock on the resource group.Wrong answer — click to see why▾
Why this is wrong here
A Read-Only lock prevents all modifications, including configuration updates, but the question requires that authorized administrators can still modify and update resources. A Delete lock only prevents deletions while allowing modifications.
★ When this WOULD be the correct answer
A company needs to prevent any changes to a critical resource group, including configuration updates, to ensure compliance with a regulatory requirement. Authorized administrators must be able to remove the lock only if they have the Owner role.
Why candidates choose this
Candidates may confuse Read-Only lock with Delete lock, thinking that 'read-only' implies only deletions are blocked, but it actually blocks all write operations.
✗An Azure RBAC role assignment that excludes the Delete action for all users.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC role assignments that exclude the Delete action for all users would prevent authorized administrators from deleting resources, contradicting the requirement that authorized administrators must still be able to delete resources. Additionally, RBAC assignments can be modified by users with sufficient permissions, unlike locks which require Owner role to remove.
★ When this WOULD be the correct answer
A question where the requirement is to prevent all users, including administrators, from deleting resources, and the solution must be implemented via granular permission control rather than a resource lock. For example: 'A company wants to ensure that no user, including administrators, can delete a specific storage account, but they still need to modify its configuration. Which feature should they use?'
Why candidates choose this
Candidates may think that excluding the Delete action via RBAC is a straightforward way to prevent deletions, but they overlook that this would also block authorized administrators and that RBAC assignments are not as restrictive as locks.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?
medium- A.Assign a custom role-based access control (RBAC) role that denies the delete action for all users.
- B.Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.
- ✓ C.Apply a resource lock of type 'Delete' at the subscription level.
- D.Apply a resource lock of type 'ReadOnly' at the subscription level.
Why C: A resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.