mediumFoundationSymptom-first#storage#resource-lock#delete#management

Storage account delete blocked by resource lock

az storage account delete returns The resource is locked and cannot be deleted

Likely source:configurationdeployment

Focused incident mode — strips away everything but this runbook.

Symptoms

  • az storage account delete returns The resource is locked and cannot be deleted
  • ARM deployment fails with a lock conflict on the storage account
  • Portal delete button is greyed out with a lock icon

Resource locks are a safety net — only remove them with a documented change request. CanNotDelete locks prevent accidental deletion, not malicious actors.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Resource locks on the account

    az lock list --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT> --output table

  • Lock level

    az lock show --name <LOCK-NAME> --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT> --query level -o tsv

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • az lock list shows CanNotDelete lock on the resource
  • Error message references the specific lock name

Confirm before fixing

az lock show --name <LOCK-NAME> --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT> --query level -o tsv
READ

Confirm the lock level

Fix

az lock delete --name <LOCK-NAME> --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT>
DESTRUCTIVE

Remove the lock (requires appropriate RBAC)

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az lock list --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT> --output table
READ

Find the blocking lock

2
az lock show --name <LOCK-NAME> --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT> --query level -o tsv
READ

Confirm the lock level

3
az lock delete --name <LOCK-NAME> --resource-group <RG> --resource-type Microsoft.Storage/storageAccounts --resource <STORAGE-ACCOUNT>
DESTRUCTIVE

Remove the lock and retry delete

4
az storage account delete --name <STORAGE-ACCOUNT> --resource-group <RG> --yes
DESTRUCTIVE

Delete the storage account after lock removal

Prevention

  • Apply CanNotDelete locks to storage accounts containing production data.
  • Use Azure Policy to require approval workflows for lock removal.
  • Document lock ownership in your ops wiki so removal is not a mystery.
  • Use management group locks for organization-wide protection, not per-resource.

Related runbooks

Same stack, same failure family — worth a skim.

Blob soft-delete vs versioning — recovering the wrong datahigh

Undelete blob returns a version that does not match the expected data

AzureAdvanced2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.