Azure AZ-104Azure GovernanceMicrosoft Azure

Article & Tutorial

Azure Resource Manager, Tags and Resource Locks: Complete Governance Guide

Learn Azure Resource Manager, control plane vs data plane, resource providers, Azure tags, resource locks, governance differences and practical Azure CLI examples.

Melochip Editorial

@melochip-editorial

Published Sep 15, 2026 5 min read
React Comments Share More
Azure Resource Manager, Tags and Resource Locks: Complete Governance Guide architecture illustration
Azure Resource Manager, Tags and Resource Locks: Complete Governance Guide architecture illustration
Contents

Azure Learning Path — Stage 1, Chapter 4. Azure Resource Manager (ARM) is the management layer behind Azure. Whether you use the portal, Azure CLI, Azure PowerShell, REST APIs, Bicep or an SDK, resource-management requests are processed through Resource Manager.

This chapter explains how ARM works, how resource providers fit into Azure, how tags help organize and report on resources, how locks protect critical infrastructure, and how these controls differ from Azure RBAC and Azure Policy.

What you will learn

  • What Azure Resource Manager does.
  • Control plane vs data plane.
  • Resource providers and resource types.
  • How resource IDs are structured.
  • How to design a tagging strategy.
  • Delete and Read-only locks.
  • Why locks are not a replacement for RBAC.
  • Hands-on Azure CLI examples.

1. What is Azure Resource Manager?

Azure Resource Manager is the deployment and management service for Azure. It provides a consistent management layer for creating, updating and deleting Azure resources.

bash
Azure Portal
Azure CLI
Azure PowerShell
Bicep / ARM templates
REST API / SDK
       |
       v
Azure Resource Manager
       |
       v
Resource Provider
       |
       v
Azure Resource

This consistency is important. If you create a storage account in the portal and then inspect it with Azure CLI, both tools are working with the same Resource Manager model.

2. Control plane vs data plane

PlanePurposeExample
Control planeManage Azure resourcesCreate a storage account, resize a VM, assign a lock
Data planeUse data inside a serviceRead a blob, query a database, retrieve a secret

This distinction matters when you design permissions and locks. A resource lock applies to control-plane operations; it does not automatically block data-plane operations inside the service.

3. Resource providers

Azure services expose resource types through resource providers. Examples include:

  • Microsoft.Compute for compute resources.
  • Microsoft.Network for networking resources.
  • Microsoft.Storage for storage resources.
  • Microsoft.KeyVault for Key Vault resources.

You can inspect providers with Azure CLI:

bash
az provider list --output table

Show resource types for a provider:

bash
az provider show \
  --namespace Microsoft.Compute \
  --query "resourceTypes[].resourceType" \
  --output table

4. Azure resource IDs

Every Azure resource has a unique Resource Manager ID. A typical ID looks like:

bash
/subscriptions/<subscription-id>
/resourceGroups/rg-demo
/providers/Microsoft.Storage
/storageAccounts/stmelochipdemo

Understanding resource IDs becomes useful for CLI commands, scripts, RBAC assignments, diagnostic settings, policy and infrastructure-as-code deployments.

5. Why tags matter

Azure tags are key-value metadata attached to supported resources, resource groups and subscriptions. They help with organization, filtering, automation, reporting and cost analysis.

Example tags:

KeyExample value
EnvironmentProduction
ApplicationPayments
OwnerPlatformTeam
CostCenterCC-1042
CriticalityHigh
DataClassificationConfidential

6. Tags do not automatically inherit

A common beginner mistake is to add a tag to a resource group and assume every child resource automatically receives the same tag. Azure does not automatically copy resource-group or subscription tags to child resources. Azure Policy can be used when you need to append, inherit or enforce tagging standards.

7. Azure tag limits and practical design

Microsoft currently documents a maximum of 50 tag name-value pairs directly on a subscription, resource group or most resources. Some resource types have additional limitations. Do not use all available tags just because you can; keep the strategy meaningful and governable.

Good tagging principles

  • Define required tags centrally.
  • Use controlled values where possible.
  • Separate ownership, environment and cost metadata.
  • Avoid putting secrets or personal sensitive data in tags.
  • Use Azure Policy to enforce important tags.

8. Add tags with Azure CLI

Create a resource group with tags:

bash
az group create \
  --name rg-arm-governance-lab \
  --location centralindia \
  --tags Environment=Dev Owner=CloudTeam CostCenter=Learning

View tags:

bash
az group show \
  --name rg-arm-governance-lab \
  --query tags

Update tags:

bash
az tag update \
  --resource-id $(az group show --name rg-arm-governance-lab --query id -o tsv) \
  --operation Merge \
  --tags Criticality=Low

9. What are Azure resource locks?

Resource locks help protect subscriptions, resource groups or resources from accidental changes. Azure exposes two common lock levels:

Portal nameCLI nameBehavior
DeleteCanNotDeleteAuthorized users can read and modify but cannot delete the protected scope.
Read-onlyReadOnlyAuthorized users can read but cannot update or delete the protected scope.

10. Locks override normal user permissions

A lock can block an operation even when the user otherwise has permission through Azure RBAC. This is why locks are useful for critical infrastructure such as shared networking, production databases or key resources that should not be accidentally deleted.

However, a lock is not a replacement for least-privilege RBAC. Locks are an additional safety mechanism.

11. Create and test a Delete lock

bash
az lock create \
  --name PreventAccidentalDelete \
  --lock-type CanNotDelete \
  --resource-group rg-arm-governance-lab

List locks:

bash
az lock list \
  --resource-group rg-arm-governance-lab \
  --output table

If you attempt to delete the resource group while the lock is active, Azure should block the operation.

Remove the lock after the lab:

bash
az lock delete \
  --name PreventAccidentalDelete \
  --resource-group rg-arm-governance-lab

12. RBAC vs locks vs Policy vs tags

FeatureMain purpose
Azure RBACWho can perform which management actions at which scope
Resource locksPrevent deletion or modification of protected resources
Azure PolicyEvaluate and enforce resource configuration standards
TagsAdd business and operational metadata

Production governance typically uses all four together.

13. Example production governance model

bash
Management Group
  └── Azure Policy: approved regions
      └── Subscription
          └── RBAC: platform team roles
              └── Resource Group
                  ├── Tags: App, Owner, CostCenter
                  └── Delete Lock
                      └── Critical resources

14. Common mistakes

  • Assuming a lock protects data-plane operations.
  • Using ReadOnly locks without testing how they affect service operations.
  • Using tags as a security boundary.
  • Expecting tags to inherit automatically.
  • Giving everyone Owner and depending on locks for safety.
  • Removing a production lock during troubleshooting and forgetting to restore it.

15. Hands-on lab

  1. Create rg-arm-governance-lab.
  2. Add Environment, Owner and CostCenter tags.
  3. Inspect the resource group’s ARM resource ID.
  4. Create a CanNotDelete lock.
  5. Try to delete the group and observe the failure.
  6. Remove the lock.
  7. Delete the test group.

16. Interview questions

  1. What is Azure Resource Manager?
  2. What is the difference between control plane and data plane?
  3. What is a resource provider?
  4. Do resource-group tags automatically inherit to resources?
  5. What is the difference between Delete and Read-only locks?
  6. How are Azure RBAC and locks different?
  7. When would you use Azure Policy rather than a tag?

Official References

  • Microsoft Learn documentation for the related Azure service and governance topic.

Did this help?

Yes No

Join the discussion

0 Comments

Ask questions, add context, or share what worked.

Sign in to join the discussion

No comments yet. Start the discussion.

More from Melochip Editorial

Related articles

Stay in the loop. Get new Melochip articles

Receive Melochip article updates when new articles are available. Explicit opt-in only.

No pre-checked boxes. Unsubscribe support is part of the subscriber foundation.