Create a resourceGroup, apply a lock and RBAC
This template is a subscription level template that creates a resource group, applies a DoNotDelete lock to that group, and assigns the contributor role to a principal specified in a template parameters.
NOTE: Role Assigments use a GUID for the name, this must be unique for every role assignment on the group. The roleAssignmentName parameter is used to seed the guid() function with this value, change it for each deployment. You can supply a guid or any string, as long as it has not been used before when assigning the role to the resourceGroup.
Tags: Microsoft.Resources/resourceGroups, Microsoft.Resources/deployments, Microsoft.Authorization/locks, Microsoft.Authorization/roleAssignments