Azure resource locks: purpose, types, scope, and how they relate to RBAC

Locks are enforced via Azure Resource Manager (ARM)

If a management request goes through ARM, a lock can block it—no matter which tool you use. Azure Resource Manager (ARM) equals management layer. Portal, Azure CLI, PowerShell, ARM/Bicep deployments use ARM. Portal labels: 'Delete' / 'Read-only'. API/CLI labels: 'CanNotDelete' / 'ReadOnly'.