# Ensure that Resource Locks are set for Mission-Critical Azure Resources

- Source: https://support.icompaas.com/support/solutions/articles/62000229860-ensure-that-resource-locks-are-set-for-mission-critical-azure-resources
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Mission-critical Azure resources must have Resource Locks configured to prevent accidental deletion or modification. Locks enforce protection at the subscription, resource group, or resource level and ensure essential services remain available and safeguarded from unintended changes.

  

Rationale:

Resource Locks provide an additional control layer to prevent configuration drift or accidental deletion by authorized users. They enforce operational discipline and protect business-critical infrastructure from outages caused by human error.

  

Impact:

Locked resources cannot be deleted or modified until the lock is removed. Operational teams must follow formal change procedures to make updates. This adds control but may slightly delay emergency fixes without proper access management.

  

Default Value:

Resource Locks: Not configured by default

  

Pre-Requisites:

-   Mission-critical Azure resources have been identified
    
-   Appropriate permissions (Owner role) are in place
    
-   Change approval has been obtained prior to implementation
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Identify the mission-critical Azure resource, resource group, or subscription.
    
3.  Open the selected resource.
    
4.  Under Settings, select Resource locks.
    
5.  Verify that a Resource Lock is present.
    
6.  Confirm the Lock type is either:
    

-   Delete, or
    
-   Read-only
    

7.  If no lock is present, follow the Implementation Steps
    

![](https://support.icompaas.com/assets/kb/4639f2475a72bf65.png)

  

Implementation Steps:

1.  Sign in to the Azure Portal at[https://portal.azure.com](https://portal.azure.com/)
    
2.  Identify the mission-critical Azure resource, resource group, or subscription.
    
3.  Open the selected resource.
    
4.  Under Settings, select Resource locks.
    

                                    ![](https://support.icompaas.com/assets/kb/4d677cdd6310203d.png)

5.  Click Add.
    
6.  Enter a Lock name (meaningful and descriptive).
    
7.  Select the Lock type:
    

-   Delete (recommended), or
    
-   Read-only (if full change restriction is required).
    

                  ![](https://support.icompaas.com/assets/kb/c3129f5b47d8054a.png)

8.  (Optional) Add a justification in the Notes field.
    
9.  Click OK to apply the lock.
    

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open the mission-critical Azure resource, resource group, or subscription.
    
3.  Under Settings, select Resource locks.
    
4.  Identify the Resource Lock to be removed.
    
5.  Select the lock and click Delete.
    
6.  Confirm the deletion of the lock.
    

  

References:

-   [https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources)
    
-   [https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking](https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking)
    
-   [https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices](https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices)[  
    ](https://learn.microsoft.com/en-us/azure/security/fundamentals/operational-security)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.