The answer is the Azure Resource Manager CanNotDelete lock. This feature is correct because it applies a restriction at the resource, resource group, or subscription level that overrides all Azure RBAC permissions, meaning even subscription owners or users with the Contributor role cannot delete the protected resource until the lock is explicitly removed. On the Microsoft Azure Fundamentals AZ-900 exam, this question tests your understanding of governance controls versus access controls—a common trap is confusing locks with RBAC roles, but remember that locks are a separate safeguard designed specifically to prevent accidental deletion of Azure resources. A helpful memory tip is to think of the CanNotDelete lock as a “super admin override” that says “no one touches this,” making it the definitive tool for preventing accidental deletion of Azure resources regardless of who holds the keys.
AZ-900 Describe Azure management and governance Practice Question
This AZ-900 practice question tests your understanding of describe azure management and governance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company wants to prevent any Azure resource from being accidentally deleted by anyone, including subscription owners. Which Azure feature accomplishes this?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Manager CanNotDelete lock
The Azure Resource Manager CanNotDelete lock is the correct feature because it prevents any user, including subscription owners, from deleting a resource. This lock overrides all RBAC permissions, ensuring that even users with Owner or Contributor roles cannot delete the resource until the lock is removed. It is specifically designed for accidental deletion prevention at the resource, resource group, or subscription level.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Azure Policy with Deny effect
Why it's wrong here
Azure Policy can prevent resource creation with certain properties but isn't designed to prevent deletion of existing resources.
✓
Azure Resource Manager CanNotDelete lock
Why this is correct
CanNotDelete lock prevents resource deletion by anyone, including owners — the lock must be explicitly removed before deletion.
Related concept
Read the scenario before looking for a memorised answer.
✗
RBAC Reader role
Why it's wrong here
Reader role prevents modification but isn't typically assigned to block owners — and can't block owners from removing the role.
✗
Azure Blueprints
Why it's wrong here
Blueprints can deploy locks but the lock itself (CanNotDelete) is what prevents deletion.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse Azure Policy (which governs compliance and creation/modification) with Azure Locks (which specifically prevent deletion), or they assume RBAC roles like Owner can always delete, forgetting that locks override RBAC.
Detailed technical explanation
How to think about this question
Azure Resource Manager locks operate at the ARM API level, applying a `CanNotDelete` or `ReadOnly` lock that is enforced as a deny assignment in the authorization chain, overriding any role-based permissions. This lock is stored as a separate resource under the `Microsoft.Authorization/locks` resource provider and can be applied to a subscription, resource group, or individual resource. A real-world scenario is protecting a production database resource group from accidental deletion during maintenance, where even the subscription owner must remove the lock explicitly before deletion.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-900 question in full detail.
Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Azure Resource Manager CanNotDelete lock — The Azure Resource Manager CanNotDelete lock is the correct feature because it prevents any user, including subscription owners, from deleting a resource. This lock overrides all RBAC permissions, ensuring that even users with Owner or Contributor roles cannot delete the resource until the lock is removed. It is specifically designed for accidental deletion prevention at the resource, resource group, or subscription level.
What should I do if I get this AZ-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?
medium
A.Azure Policy with the deny effect to block deletion of the storage account
B.An Azure Blueprint that includes the storage account with a policy to prevent deletion
C.A Read-only lock on the storage account
✓ D.A Delete lock on the storage account
Why D: Option D is correct because a Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.
Variation 2. A company stores critical financial records in an Azure Storage account. The operations team needs to ensure that the storage account cannot be deleted by any user, including administrators with Contributor permissions. However, authorized users must still be able to add and modify blobs. The solution should not affect the ability to update the account's configuration. Which Azure feature should the company implement?
medium
A.Assign the Storage Blob Data Owner role to the operations team.
✓ B.Apply a CanNotDelete resource lock on the storage account.
C.Create an Azure Policy that denies delete operations on storage accounts.
D.Move the storage account to a new resource group.
Why B: A CanNotDelete resource lock on the storage account prevents any user, including those with Contributor permissions, from deleting the resource. This satisfies the requirement that even administrators cannot delete the account, while still allowing authorized users to add and modify blobs (since blob operations are controlled by Azure RBAC roles, not the lock) and update the account's configuration (the lock only blocks delete operations).
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.