You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As an administrator, you may need to lock an Azure Cosmos DB account, database or container. Locks prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to ``CanNotDelete`` or ``ReadOnly``.
20
+
As an administrator, you may need to lock an Azure Cosmos DB account, database or container. Locks prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to `CanNotDelete` or `ReadOnly`.
20
21
21
22
| Level | Description |
22
23
| --- | --- |
23
-
|``CanNotDelete``| Authorized users can still read and modify a resource, but they can't delete the resource. |
24
-
|``ReadOnly``| Authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the **Reader** role. |
24
+
|`CanNotDelete`| Authorized users can still read and modify a resource, but they can't delete the resource. |
25
+
|`ReadOnly`| Authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the **Reader** role. |
26
+
27
+
## Prerequisites
28
+
29
+
- An existing Azure Cosmos DB account.
30
+
- If you have an Azure subscription, [create a new account](nosql/how-to-create-account.md?tabs=azure-portal).
31
+
- If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
32
+
- Alternatively, you can [try Azure Cosmos DB free](try-free.md) before you commit.
25
33
26
34
## How locks are applied
27
35
28
36
When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the lock from the parent. The most restrictive lock in the inheritance takes precedence.
29
37
30
38
Unlike Azure role-based access control, you use management locks to apply a restriction across all users and roles. To learn about role-based access control for Azure Cosmos DB see, [Azure role-based access control in Azure Cosmos DB](role-based-access-control.md).
31
39
32
-
Resource Manager locks apply only to operations that happen in the management plane, which consists of operations sent to <https://management.azure.com>. The locks don't restrict how resources perform their own functions. Resource changes are restricted, but resource operations aren't restricted. For example, a ReadOnly lock on an Azure Cosmos DB container prevents you from deleting or modifying the container. It doesn't prevent you from creating, updating, or deleting data in the container. Data transactions are permitted because those operations aren't sent to <https://management.azure.com>.
40
+
Resource Manager locks apply only to operations that happen in the management plane, which consists of operations sent to `https://management.azure.com`. The locks don't restrict how resources perform their own functions. Resource changes are restricted, but resource operations aren't restricted. For example, a ReadOnly lock on an Azure Cosmos DB container prevents you from deleting or modifying the container. It doesn't prevent you from creating, updating, or deleting data in the container. Data transactions are permitted because those operations aren't sent to `https://management.azure.com`.
33
41
34
42
## Manage locks
35
43
36
-
Resource locks don't work for changes made by users accessing Azure Cosmos DB using account keys unless the Azure Cosmos DB account is first locked by enabling the ``disableKeyBasedMetadataWriteAccess`` property. Ensure this property doesn't break existing applications that make changes to resources using any SDK, Azure portal, or third party tools. Enabling this property will break applications that connect via account keys and modify resources such as changing throughput, updating index policies, etc. To learn more and to go through a checklist to ensure your applications continue to function, see [preventing changes from the Azure Cosmos DB SDKs](role-based-access-control.md#prevent-sdk-changes)
44
+
Resource locks don't work for changes made by users accessing Azure Cosmos DB using account keys unless the Azure Cosmos DB account is first locked by enabling the `disableKeyBasedMetadataWriteAccess` property. Ensure this property doesn't break existing applications that make changes to resources using any SDK, Azure portal, or third party tools. Enabling this property breaks applications that connect via account keys to modify resources. These modifications can include changing throughput, updating index policies, etc. To learn more and to go through a checklist to ensure your applications continue to function, see [preventing changes from the Azure Cosmos DB SDKs](role-based-access-control.md#prevent-sdk-changes)
37
45
38
46
### [PowerShell](#tab/powershell)
39
47
40
48
```powershell-interactive
41
-
$RESOURCE_GROUP_NAME = "myResourceGroup"
42
-
$ACCOUNT_NAME = "my-cosmos-account"
43
-
$LOCK_NAME = "$accountName-Lock"
49
+
$RESOURCE_GROUP_NAME = "<resource-group>"
50
+
$ACCOUNT_NAME = "<account-name>"
51
+
$LOCK_NAME = "$ACCOUNT_NAME-lock"
44
52
```
45
53
46
54
First, update the account to prevent changes by anything that connects via account keys.
0 commit comments