How to Prevent Users from Removing Resource Group Locks Using Azure Policy?

Ens 21 Reputation points
2024-09-04T07:55:24.4666667+00:00

Hi,

I'm currently working on creating a policy definition in Azure to prevent users from removing locks from Resource Groups (RGs). My initial approach was to use the Deny effect within the policy, but I haven't been able to achieve the desired result.

I'm wondering if using the Deny effect is the correct approach for this scenario, or should I consider using the deployIfNotExists effect instead? I want to ensure that the locks on the Resource Groups cannot be removed by any user. Could someone please guide me on how to properly implement this policy or suggest the best approach to achieve this?

Thank you in advance for your help!

Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
872 questions
0 comments
Accepted answer
  1. Prashant Kumar 775 Reputation points Microsoft Employee
    2024-09-06T06:53:27.1766667+00:00

    Hi Ens,

    Deny policy effect cannot be applied on the resource group to prevent users from deleting the lock as this only works with create/update - PUT/PATCH operation on the resources or resource groups and not on DELETE operations.

    Unfortunately, Deny Action cannot be applied here as well as Microsoft.Authorization/locks are all exempted from denyAction enforcement to prevent lockout scenarios.

    https://video2.skills-academy.com/en-us/azure/governance/policy/concepts/effect-deny-action#denyaction-evaluation

    The recommended approach would be to use DINE policy effect to apply locks on the resource group OR limit owner or user access admin permission or any custom role with actions Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions to users/groups.

    https://video2.skills-academy.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#who-can-create-or-delete-locks

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.