# Ensure a Custom Role is Assigned Permissions for Administering Resource Locks

- Source: https://support.icompaas.com/support/solutions/articles/62000229811-ensure-a-custom-role-is-assigned-permissions-for-administering-resource-locks
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control ensures that permissions for managing Azure resource locks are granted only through a custom role. Using a custom role limits access to lock-related actions, prevents accidental changes or deletions of critical resources, and provides better control over who can modify or remove protection settings.

  

Rationale:

Restricting resource lock management to a custom role reduces the risk of unauthorized deletion or modification of critical resources. It enforces least privilege access and ensures accountability by allowing only approved users to manage protection controls.

  

Impact:

Only users assigned the custom role will be able to manage resource locks. Other users may lose the ability to change or remove locks, which improves security but may require role updates for teams that previously had broad permissions.

  

Pre-requisites:

-   Azure subscription access
    
-   Owner or User Access Administrator role
    
-   Custom roles feature enabled
    
-   Approved list of users who should manage locks  
      
    

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Subscriptions and select the relevant subscription
    
3.  Open Access control (IAM)
    
4.  Select Roles and review Custom roles
    

![](https://support.icompaas.com/assets/kb/dea189c0dcc7ead3.png)

![](https://support.icompaas.com/assets/kb/285e05c73a7b5e5f.png)

5.  Verify a custom role exists with permissions to manage resource locks
    
6.  Verify the custom role is assigned to the intended users or groups
    
7.  If a custom role with resource lock permissions is not present or assigned, follow the implementation steps
    

  

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Subscriptions and select the relevant subscription
    
3.  Select Access control (IAM)
    

                         ![](https://support.icompaas.com/assets/kb/5bce3a8d316eb20e.png)

4.  Select Roles and choose Create
    
5.  Click on Add Select Custom role
    

![](https://support.icompaas.com/assets/kb/e4722577c094842a.png)

6.  Enter a role name and description for administering resource locks
    
7.  Add the following permissions individually under Microsoft.Authorization
    
    -   Add Microsoft.Authorization/locks/read
        
    -   Add Microsoft.Authorization/locks/write
        
    -   Add Microsoft.Authorization/locks/delete
        
8.  Set the assignable scope to the required subscription or resource group
    
9.  Create and save the custom role  
      
    

Backout plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Subscriptions and select the relevant subscription
    
3.  Select Access control (IAM)
    
4.  Select Roles and open the custom role for resource locks
    
5.  Remove the role assignment or delete the custom role
    
6.  Save the changes
    

  

Reference:

-   [https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources)
    
-   [https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)
    
-   [https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.