Azure resource locks: purpose, types, scope, and how they relate to RBAC

Scenario: prevent deletions, allow changes

Use CanNotDelete when you want normal operations to continue but deletion to be blocked. Apply CanNotDelete at resource group scope. Updates (scale/config) still work. Deletes are blocked (inherited by resources). Avoid ReadOnly if you still need routine changes.