Azure resource lock inconsistent behavior

Question

Azure resource lock inconsistent behavior

Sushil 0

Hi,

While reporting this question, I was looking for "Network Security Group" in the child tag but could not find it.

This issue is related to inconsistent resource lock behavior observed in Azure.

Summary:

When a resource group has "Delete" type resource lock, resources in that RG cannot be deleted.

There is a specific scenario, when the resource could be deleted. I want to report this observation and seek confirmation/clarification on what should be the correct behavior in the scenario described below:

Scenario:

resource group exists and has a "Delete" lock enabled.
A network security group is deployed under the resource group and has few security rules.
I try to delete a security rule as shown below and I receive an error as shown in the screenshot:

User's image

this error appears to be correct behavior, the resource lock on RG is preventing delete of the security rule.

4.

Now, I try to delete the security rule as shown in the following screenshot:

User's image

and result:

User's image

Observation is that, in spite having resource lock on the RG, its effect on the security rule delete operation depends on the way it is being deleted.

Now question is:

whether security rule delete operation should succeed when the RG has lock, irrespective of the steps followed to delete it?

Please advise.

This similar behavior may also be observed for similar resources with parent and child relationships.

If you are fixing this issue, yokotenkai is advised.

#nsg #resourcelock #securityrule #delete

1 answer

Your answer

Answer 1

Hello Sushil
I understand you're trying to delete the NSG rule but can't because a Lock is set on your resource group. You tried two different methods your first attempt didn't work, but the second one was successful even though the lock was applied at the RG level.

I also tested both methods in my lab environment, but I couldn't delete the rule when a Lock was applied at the resource group level. Check the below screen shots.

I clicked the delete option directly, but the operation failed. Please see the screenshot.
User's image

Selecting the checkbox, after clicking the top delete option did not work. User's image After changing the resource lock option to 'delete', I tried the first method, but it didn't work for deleting the rule. However, the rule was successfully deleted using the second method. Check the screen shots. Direct deletion isn't working; it's prompting for confirmation before deleting. This issue might be related to the way the deletion is being performed. It’s a good idea to review the deletion method and confirm that it uses the Azure Resource Manager (ARM) control plane, rather than any data plane operations, since only the control plane is affected by locks.
User's image

User's image

From my understanding, if you set the lock type to read-only, you won't be able to perform any actions at the resource group level. If you use a delete lock, you can still delete rules at the resource level, but you won't be able to delete the resource itself. Additionally, implementing any new rule is still possible.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Sushil 0 Reputation points

2025-08-09T05:35:50.0166667+00:00

Praveen,

thanks for acknowledging my post and the observation reported.

here are my thoughts:

user expects consistent "delete" lock behavior

if different outcomes exist for such an important security feature depending on which steps user is taking, it can help users to bypass the lock and impact the resources (not only NSG but resources with such parent/child relation)

governance may become tedious

i believe data plan operation is not involved in any of the operation i had described in my post.

as per my investigation, following is the probable reason of this behavior:

when security rule is deleted by clicking delete button on the right of the rule, the DELETE operation is carried out on the resource of type Microsoft.Network/networkSecurityGroups/securityRules. DELETE operation is prevented due to the RG lock.

when security rule is deleted by delete button on the top after selecting checkbox against the security rule, the UPDATE operation is carried out on the resource type Microsoft.Network/networkSecurityGroups. UPDATE operation is not prevented by the RG lock.

your thoughts?

thanks,

Sushil
Praveen Bandaru 6,850 Reputation points Microsoft External Staff Moderator

2025-08-12T02:09:47.03+00:00

Hello Sushil
Thank you for your response. You are correct; the data plan operation is not involved, as this is strictly a Control Plane issue. When attempting to delete the force pully, the deletion is restricted because the Resource Group is locked. However, if you use the delete button, the RG operation reflects the deletion at the Resource Group level, which allows you to proceed. Your observation is correct.

Share via

Azure resource lock inconsistent behavior

1 answer

Your answer