Share via

az lock

Manage Azure locks.

Commands

Name Description Type Status
az lock create

Create a lock.

 Core GA
az lock delete

Delete a lock.

 Core GA
az lock list

List lock information.

 Core GA
az lock show

Show the properties of a lock.

 Core GA
az lock update

Update a lock.

 Core GA

az lock create

Edit

Create a lock.

Locks can exist at three different scopes: subscription, resource group and resource. For how to add locks at different levels, please refer to the following examples.

az lock create --lock-type {CanNotDelete, ReadOnly}
               --name
               [--namespace]
               [--notes]
               [--parent]
               [--resource --resource-name]
               [--resource-group]
               [--resource-type]

Examples

Create a read-only subscription level lock.

az lock create --name lockName --lock-type ReadOnly

Create a read-only resource group level lock.

az lock create --name lockName --resource-group group --lock-type ReadOnly

Create a read-only resource level lock on a vnet resource.

az lock create --name lockName --resource-group group --lock-type ReadOnly --resource-type \
    Microsoft.Network/virtualNetworks --resource myVnet

Create a read-only resource level lock on a subnet resource with a specific parent.

az lock create --name lockName --resource-group group --lock-type ReadOnly --resource-type \
    Microsoft.Network/subnets --parent virtualNetworks/myVnet --resource mySubnet

Required Parameters

--lock-type -t

The type of lock restriction.

Property Value
Accepted values: CanNotDelete, ReadOnly
--name -n

Name of the lock.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--notes

Notes about this lock.

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az lock delete

Edit

Delete a lock.

Locks can exist at three different scopes: subscription, resource group and resource. For how to delete locks at different levels, please refer to the following examples.

az lock delete [--ids]
               [--name]
               [--namespace]
               [--parent]
               [--resource --resource-name]
               [--resource-group]
               [--resource-type]

Examples

Delete a subscription level lock

az lock delete --name lockName

Delete a resource group level lock

az lock delete --name lockName --resource-group group

Delete a resource level lock

az lock delete --name lockName --resource-group group --resource resourceName --resource-type resourceType

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az lock list

Edit

List lock information.

az lock list [--filter-string]
             [--namespace]
             [--parent]
             [--resource --resource-name]
             [--resource-group]
             [--resource-type]

Examples

List out the locks on a vnet resource. Includes locks in the associated group and subscription.

az lock list --resource myvnet --resource-type Microsoft.Network/virtualNetworks -g group

List out all locks on the subscription level

az lock list

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--filter-string

A query filter to use to restrict the results.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az lock show

Edit

Show the properties of a lock.

az lock show [--ids]
             [--name]
             [--namespace]
             [--parent]
             [--resource --resource-name]
             [--resource-group]
             [--resource-type]

Examples

Show a subscription level lock

az lock show -n lockname

Show the properties of a lock (autogenerated)

az lock show --name lockname --resource-group MyResourceGroup --resource-name MyResource --resource-type Microsoft.Network/virtualNetworks

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az lock update

Edit

Update a lock.

az lock update [--ids]
               [--lock-type {CanNotDelete, ReadOnly}]
               [--name]
               [--namespace]
               [--notes]
               [--parent]
               [--resource --resource-name]
               [--resource-group]
               [--resource-type]

Examples

Update a resource group level lock with new notes and type

az lock update --name lockName --resource-group group --notes newNotesHere --lock-type CanNotDelete

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). If provided, no other "Resource Id" arguments should be specified.

--lock-type -t

The type of lock restriction.

Property Value
Accepted values: CanNotDelete, ReadOnly
--name -n

Name of the lock.

--namespace

Provider namespace (Ex: 'Microsoft.Provider').

--notes

Notes about this lock.

--parent

The parent path (Ex: 'resA/myA/resB/myB').

--resource --resource-name

Name or ID of the resource being locked. If an ID is given, other resource arguments should not be given.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

The resource type (Ex: 'resC'). Can also accept namespace/type format (Ex: 'Microsoft.Provider/resC').

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False