Azure resource locks: purpose, types, scope, and how they relate to RBAC

Control plane vs data plane

Locks target control plane (management) actions, not the service's data operations. Control plane (management plane): create/update/delete resource via ARM. Data plane: use the service (read/write/query data). Locks apply to control plane actions. Data plane permissions depend on the service and access controls.