Lab: govern safe resource and subscription changes

Outcome

Create training resource groups, apply and test both lock kinds, validate a resource move before making it, and inspect subscription and management-group access without initiating a real billing transfer or cancellation. You will deliberately choose a blocked operation, diagnose the correct scope or prerequisite, and clean up.

Before you begin

Use a non-production subscription where you can create resource groups, a storage account, and locks. Do not transfer billing ownership, move a subscription to another tenant, or cancel a subscription in this lab. Those actions can remove access and require account-specific planning.

az group create --name rg-azlearn-governance-a --location <azure-region>
az group create --name rg-azlearn-governance-b --location <azure-region>
az storage account create --name <unique-training-storage> --resource-group rg-azlearn-governance-a --sku Standard_LRS

Do: locks and their scope

1. Create a CanNotDelete lock on the training storage account. Try to delete that account; the operation should fail. Confirm that a permitted configuration update still succeeds, then remove the lock.

   az lock create --name training-no-delete --lock-type CanNotDelete \
     --resource-group rg-azlearn-governance-a --resource-name <unique-training-storage> \
     --resource-type Microsoft.Storage/storageAccounts
   az lock list --resource-group rg-azlearn-governance-a -o table

2. Create a ReadOnly lock on the training resource group. Attempt a harmless control-plane update such as adding a resource tag; record the blocked result. Then test that you can still perform a harmless data-plane action allowed by the storage service. A lock affects control-plane operations, not every request to a service endpoint. Remove the ReadOnly lock.

3. Apply a CanNotDelete lock at the resource-group scope, list its effective scope, and explain why a child resource inherits it. Remove the group lock before proceeding.

Do: resource-group moves

1. Record resource IDs and dependencies in rg-azlearn-governance-a. Check the current move-support guidance for every resource type, target subscription quota, provider registration, and whether source/target subscriptions share a tenant.

2. Validate the planned move before executing it. Replace placeholders with actual IDs:

   az resource invoke-action --action validateMoveResources \
     --ids '/subscriptions/<sub-id>/resourceGroups/rg-azlearn-governance-a' \
     --request-body '{"resources":["/subscriptions/<sub-id>/resourceGroups/rg-azlearn-governance-a/providers/Microsoft.Storage/storageAccounts/<unique-training-storage>"],"targetResourceGroup":"/subscriptions/<sub-id>/resourceGroups/rg-azlearn-governance-b"}'

3. If validation succeeds, use the portal’s Resource group > Move > Move to another resource group flow. Verify the storage account’s new resource ID and update any script that held its former group ID. If validation fails, do not force the move: include each dependent resource, correct the target/prerequisite, and validate again.

Do: subscription and management-group boundaries

1. Open the training subscription’s Access control (IAM) and Cost Management + Billing views. Record the subscription ID, tenant ID, billing scope, Owners, and the least privileged role that permits your training operation. A subscription is a billing and access boundary; a resource group is not a billing-account substitute.
2. If the tenant has a training management group, move only the training subscription between training management groups after an administrator approves the inherited policy/RBAC effect. Record the source/target parent and the inherited assignments. A subscription has one management-group parent at a time.
3. Read, but do not execute, the tenant’s subscription-transfer policy and transfer checklist. In particular, identify the transfer type, source/destination tenant, access-recreation plan, and billing owner. A cross-tenant subscription transfer can remove role assignments and custom roles; it is not a resource-group move.

Verify

Capture the lock type/scope and blocked action; control-plane versus data-plane result; move-validation output and final resource ID; subscription tenant/billing/access evidence; and management-group inheritance result. You should now understand: a lock restricts management operations at its scope; a move needs provider/dependency validation; a subscription transfer is a billing and identity-boundary change, not a rename.

Break and fix

1. Leave the group ReadOnly lock in place and attempt to tag the storage account. Identify the inherited lock in the error, remove only the training lock, and retry.
2. Try to validate a move without including a required dependent resource or to an invalid target group. Capture the validation error, correct the resource set/target, and revalidate before any move.
3. Compare two hypothetical subscription transfers: billing ownership inside the same tenant and a transfer that also moves the subscription to a new tenant. Explain which one preserves existing Azure RBAC access and which requires a role/identity recreation plan. Do not send either request.

Scenario practice

1. Configure: A team must prevent accidental deletion but still update a resource. Choose CanNotDelete or ReadOnly and specify the scope.
2. Diagnose: A resource-group delete fails even though the group has no displayed lock. What child resources and inherited scopes do you inspect?
3. Distinguish: Contrast moving a resource group, moving resources to another subscription, changing a subscription’s management group, and transferring billing ownership to another tenant.

Clean up

Remove every training lock first, then delete both resource groups:

az lock delete --name training-no-delete --resource-group rg-azlearn-governance-a \
  --resource-name <unique-training-storage> --resource-type Microsoft.Storage/storageAccounts
az group delete --name rg-azlearn-governance-a --yes --no-wait
az group delete --name rg-azlearn-governance-b --yes --no-wait

Remove or restore only the training subscription’s management-group placement. Do not alter billing ownership or cancel a subscription as cleanup.

Sources and re-audit

• Lock Azure resources, checked 2026-08-22.
• Move resources between resource groups or subscriptions, checked 2026-08-22.
• Move resources overview, checked 2026-08-22.
• Transfer a subscription to another Entra directory, checked 2026-08-22.
• Manage management groups, checked 2026-08-22.

Re-audit when move support, lock behavior, tenant-transfer policies, or management-group permissions change.

Related

Resource locks · Resource group · Subscription · Management groups · Scope · Identity and governance path · All labs