Azure Resource Manager Tagging and Locking Scenarios

30 minutes
  • 3 Learning Objectives

About this Hands-on Lab

In this lab, we will test several scenarios in the Azure portal. We will begin by adding tags and locks to a resource group and deploying a VM. We will then add locks to the VM resources and see if we can add tags to them after they are locked. Finally, we will explore if a resource group can be deleted if it is locked or even if the resources inside it are locked.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Discover How Locks and Tags Affect Deployments
  1. Add a tag to the resouce group.
  2. Lock the resource group with a Read-Only lock and attempt to deploy a VM to it.
  3. Lock the resource group with a Delete lock and attempt to deploy a VM to it.
  4. After successful deployment, verify if tags have been inherited.
Determine If Tags Can Be Added to Locked Resources
  1. Lock one of the VM resources with a Read-Only lock.
  2. Lock one of the VM resources with a Delete resource.
  3. Attempt to add tags to all of the resources at once.
  4. Verify if any of the locks prevented adding tags.
Explore What Happens When Attempting to Delete a a Resource Group with Locks on It (or on the Resources inside It)
  1. Attempt to delete the resource group with the Delete lock on it.
  2. Remove the resource group lock.
  3. Attempt to delete the resource group with locks on the resources inside it.
  4. Remove resource locks.
  5. Delete the resource group.

Additional Resources

You should be familiar with the following to use this hands-on lab:

  • Azure Resource Manager
  • Azure Resource Groups
  • Azure Resource Tags
  • Azure Resource Locks

Note about lab startup:

When starting up the lab environement, you may see an error such as:

    An error occured when trying to fetch resources. Additional details from the underlying API that might be helpful: Please provide below info when asking for support: timestamp = 2022-02-08T18:43:45.8593786Z, correlationId = 11343c5a-9f20-4ef0-a67d-614bbe889e37. (Code: AccessDenied) Access is denied to the requested resource. The user might not have enough permission. (Code: AccessDenied) Try refreshing the page. Your resources aren't affected by the issue, we're just having trouble showing this view right now. To see a list of resources, select Simplified View.

This is a known error and can be disregarded. It will not prevent you from working in the lab environment.

Note about environment limitations:

Due to some limitations on the Cloud Playground/hands-on lab environment, there are some actions that are not permitted. One of them is that the user account does not have permission to create a new resource group.

How does this apply to our scenario?

  • The end of this lab will be to delete the resource group. Once this is performed, there will not be any more permitted actions in the environment because you will not be able to create a new resource group.

I understand that this is a bit confusing due to the unique limitations of the ACG environments, so please feel free to reach out if you are experiencing problems or if you have any other questions.

Here is some more information about the environment limitations: Azure Cloud Sandbox.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started
Who’s going to be learning?