AZIAM-010: Resource locks configuration
- Platform
- Entra ID / M365
- Category
- Azure IAM & Resource Security
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Azure resource locks prevent accidental deletion or modification of critical resources such as production databases, networking components, and key vaults. Without resource locks, users with sufficient permissions can inadvertently destroy infrastructure, causing service outages and potential data loss. Applying CanNotDelete or ReadOnly locks to critical resources provides an additional safety layer beyond RBAC.
Recommended value
Apply CanNotDelete locks on all production resource groups and critical individual resources
Remediation
Identify all production and business-critical resource groups and resources that should be protected from accidental deletion or modification. Apply CanNotDelete locks at the resource group level for production environments and ReadOnly locks for immutable infrastructure components. Document the lock strategy and ensure that operational procedures include lock removal steps when intentional changes are required, with appropriate change management approval.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
| partial-collection | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6