# Ensure Azure Resource Manager Delete Locks Are Applied to Azure Storage Accounts

- Source: https://support.icompaas.com/support/solutions/articles/62000234841-ensure-azure-resource-manager-delete-locks-are-applied-to-azure-storage-accounts
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   Level 1

Description:  
 Delete locks prevent accidental or unauthorized deletion of Azure Storage Accounts by restricting delete operations. Applying Resource Manager Delete Locks ensures that critical storage accounts remain protected against deletion until the lock is explicitly removed.

Rationale:  
 Applying delete locks safeguards important resources from accidental deletion or malicious actions, supporting operational continuity and data protection. It adds a layer of administrative control to resource management.

Impact:

Pros:  

-   Prevents accidental or unauthorized deletion of storage accounts.  
    
-   Enhances resource protection and operational stability.  
    
-   Supports compliance with change management policies.  
    

Cons:  

-   Requires additional administrative steps to delete or modify locked resources.  
    
-   May cause delays if locks are not tracked or communicated properly.  
    

Default Value:  
 Delete locks are not applied by default and must be configured manually.

Pre-requisites:

-   Permissions to manage resource locks in the Azure subscription.  
    
-   Identification of critical storage accounts requiring protection.  
    

**

Test Plan:

**

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to the target Storage Account.  
    
3.  Select Locks under the Settings section.
    
4.  Verify if a Delete lock exists.
    

**Using Azure CLI:**

1.  List locks on the storage account:  
    
    \# az lock list --resource-group <resource-group> --resource-name <storage-account-name> --resource-type Microsoft.Storage/storageAccounts
    
2.  Confirm presence of a lock with level set to Delete.  
    

### **Implementation Plan**

**Using Azure Portal:**

1.  In the storage account’s Locks section, add a new lock.
    
2.  Set the lock Level to Delete.  
    
3.  Provide a descriptive name and notes, then save.  
    

**Using Azure CLI:**

1.  Create a delete lock on the storage account:  
    
    \# az lock create --name <lock-name> --resource-group <resource-group> --resource-name <storage-account-name> --resource-type Microsoft.Storage/storageAccounts --lock-type Delete
    

### Backout Plan:

**Using Azure Portal:**

1.  Remove the delete lock when necessary by selecting the lock and deleting it.  
    
2.  Communicate the removal to relevant teams.  
    

**Using Azure CLI:**

1.  Delete the lock:  
    
    \# az lock delete --name <lock-name> --resource-group <resource-group> --resource-type Microsoft.Storage/storageAccounts --resource-name <storage-account-name>
    

References:

-   [Manage Azure Resource Locks  
    ](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources)[Prevent Accidental Deletion with Locks  
    ](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources#lock-levels)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.