Azure resource locks: purpose, types, scope, and how they relate to RBAC

Scenario: freeze a resource

Use ReadOnly when you want to block both updates and deletions at the management layer. Apply ReadOnly at resource scope (or higher if needed). Blocks updates and deletes. Good for 'must not change' resources. CanNotDelete still allows updates.