Is it possible to use Azure Policy to apply CanNotDelete locks at resource level?

Question

I am trying to use Azure Policy to track compliance of resources with or without locks on and if a resource doesn't have a lock on, then apply the lock. I have been able to get Azure Policy to apply CanNotDelete locks at the ResourceGroup level, however I don't want to apply them at that level and instead want to apply them at the resource level (storage accounts, key vault, etc.). Is it possible to use Azure Policy as the method to apply locks at resource level?

Answer 1

Hi @Chad Woodhead ,

Yes, it is possible to use Azure Policy as the method to apply locks at the resource level. Please read this documentation: Lock Resources to Prevent Unexpected Changes on how to do this in the Azure portal.

You can also use Azure PowerShell to accomplish this as well. To lock a resource, provide the name of the resource, its resource type, and its resource group name.

New-AzResourceLock -LockLevel CanNotDelete -LockName LockSite -ResourceName examplesite -ResourceType Microsoft.Web/sites -ResourceGroupName exampleresourcegroup  

Hope that helps. Please let us know if you have further questions

Thanks,
Grace

--If the reply is helpful, please Upvote and Accept as answer--