Azure resource locks: purpose, types, scope, and how they relate to RBAC

Lock types: CanNotDelete vs ReadOnly

Choose the lock based on whether updates should remain possible. CanNotDelete: read plus update allowed, delete blocked. ReadOnly: read allowed, update plus delete blocked. Rule of thumb: 'block deletion' vs 'freeze changes'. Be careful: ReadOnly can break normal operations.