az lock

Manage Azure locks.

Commands

az lock create	Create a lock.
az lock delete	Delete a lock.
az lock list	List lock information.
az lock show	Show the properties of a lock.
az lock update	Update a lock.

az lock create

Create a lock.

Locks can exist at three different scopes: subscription, resource group and resource. For how to add locks at different levels, please refer to the following examples.

az lock create --lock-type {CanNotDelete, ReadOnly}
               --name
               [--namespace]
               [--notes]
               [--parent]
               [--resource]
               [--resource-group]
               [--resource-type]

Examples

Create a read-only subscription level lock.

az lock create --name lockName --lock-type ReadOnly

Create a read-only resource group level lock.

az lock create --name lockName --resource-group group --lock-type ReadOnly

Create a read-only resource level lock on a vnet resource.

az lock create --name lockName --resource-group group --lock-type ReadOnly --resource-type \
    Microsoft.Network/virtualNetworks --resource myVnet

Create a read-only resource level lock on a subnet resource with a specific parent.

az lock create --name lockName --resource-group group --lock-type ReadOnly --resource-type \
    Microsoft.Network/subnets --parent virtualNetworks/myVnet --resource mySubnet

Required Parameters

--lock-type -t

The type of lock restriction.

accepted values: CanNotDelete, ReadOnly

--name -n

Name of the lock.

Optional Parameters

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--notes

Notes about this lock.

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az lock delete

Delete a lock.

Locks can exist at three different scopes: subscription, resource group and resource. For how to delete locks at different levels, please refer to the following examples.

az lock delete [--ids]
               [--name]
               [--namespace]
               [--parent]
               [--resource]
               [--resource-group]
               [--resource-type]

Examples

Delete a subscription level lock

az lock delete --name lockName

Delete a resource group level lock

az lock delete --name lockName --resource-group group

Delete a resource level lock

az lock delete --name lockName --resource-group group --resource resourceName --resource-type resourceType

Optional Parameters

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az lock list

List lock information.

az lock list [--filter-string]
             [--namespace]
             [--parent]
             [--resource]
             [--resource-group]
             [--resource-type]

Examples

List out the locks on a vnet resource. Includes locks in the associated group and subscription.

az lock list --resource myvnet --resource-type Microsoft.Network/virtualNetworks -g group

List out all locks on the subscription level

az lock list

Optional Parameters

--filter-string

A query filter to use to restrict the results.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az lock show

Show the properties of a lock.

az lock show [--ids]
             [--name]
             [--namespace]
             [--parent]
             [--resource]
             [--resource-group]
             [--resource-type]

Examples

Show a subscription level lock

az lock show -n lockname

Show the properties of a lock (autogenerated)

az lock show --name lockname --resource-group MyResourceGroup --resource-name MyResource --resource-type Microsoft.Network/virtualNetworks

Optional Parameters

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az lock update

Update a lock.

az lock update [--ids]
               [--lock-type {CanNotDelete, ReadOnly}]
               [--name]
               [--namespace]
               [--notes]
               [--parent]
               [--resource]
               [--resource-group]
               [--resource-type]

Examples

Update a resource group level lock with new notes and type

az lock update --name lockName --resource-group group --notes newNotesHere --lock-type CanNotDelete

Optional Parameters

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--lock-type -t

The type of lock restriction.

accepted values: CanNotDelete, ReadOnly

--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--notes

Notes about this lock.

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.