Properties.locks block, in the same place that excludedPrincipals is, an excludedActions 'value': 'Contoso/Online/Shopping/Production'ĭeny assignment in a blueprint assignment,Īzure resource provider operations. To look like this: PUT /providers/Microsoft.Blueprint/blueprints/simpleBlueprint', To assign the blueprint to a management group instead of a subscription, the REST API call changes Group have the permissions needed to remove the blueprint assignment. In this scenario, only Owners of the management The only option to prevent subscription owners from removing a blueprint assignment is toĪssign the blueprint to a management group. This security measure protects the consistency of the defined blueprint and the environment it wasĭesigned to create from accidental or programmatic deletion or alteration. Read Only or Do Not Delete option, not even the subscription owner can perform the blocked This access isn't the case when Azureīlueprints applies locking as part of a deployed assignment. 'Owner' role, to be allowed to alter or delete any resource. It's typically possible for someone with appropriate Azure role-based accessĬontrol (Azure RBAC) on the subscription, such as the Not Locked resources can be added, moved, changed, or deleted from this resource group. The resources can be altered, but can't be deleted. The resource can't be altered in any way. The resource group is read only and tags on the resource group can't be modified. This state is also used for resources added to a Read Only or Do Not Delete resource group artifact from outside a blueprint assignment. Resources aren't protected by Azure Blueprints. The following table can be used to determine the state of a resource: Mode Only, Cannot Edit / Delete, or Cannot Delete. Resources created by artifacts in a blueprint assignment have four states: Not Locked, Read

Locking modes, however, can't be changed outside of Azure Blueprints. A different locking mode can be set by updating the blueprint assignment. The locking mode is configured during artifact deployment during aīlueprint assignment. Locking Mode applies to the blueprint assignment and it has three options: Don't Lock, Read Existing resources, such as those in resource groups thatĪlready exist, don't have locks added to them.

Resource locks deployed by Azure Blueprints are only applied toĭeployed by the blueprint assignment.

Blueprint group management