Azure Resource Manager: Resource Groups, Providers, Tags, Locks, and IDs

Azure Resource Manager is the management control plane for Azure. It receives create, read, update, delete, access, policy, deployment, and tagging operations. Resources live in subscriptions and usually in resource groups. Providers define resource types; IDs give every resource an unambiguous address; tags add metadata; locks reduce accidental change.

Lab: 25 minutes · Cost: resource groups, tags, and locks have no separate charge · Creates: one empty resource group and an optional delete lock.

What is the Azure hierarchy?

Rendering diagram...

Management groups help enterprises apply policy and access above subscriptions. Resource groups are flat; they cannot contain other resource groups. Put resources together when they share lifecycle, ownership, environment, and deployment boundaries—not merely because they use the same technology.

How can you create a resource group?

Ways to build

Choose the Azure tool you want to use. The underlying resource stays the same.

Search Resource groups, then select Create.

Azure portal Resource groups page with Create highlighted

Choose the subscription, enter rg-northstar-dev-001, choose a metadata location, add tags, review, and create.

Azure portal form for subscription, resource group name, and region

The resource-group location stores its metadata. Resources inside can be in different regions, though a deliberate regional design is easier to operate.

Use a subscription-scope template because the target resource group does not exist yet:

bicep

targetScope = 'subscription'

param location string = 'eastus'

resource labGroup 'Microsoft.Resources/resourceGroups@2024-11-01' = {
  name: 'rg-northstar-dev-001'
  location: location
  tags: {
    environment: 'learning'
    workload: 'northstar'
    owner: 'cloud-team'
  }
}

Deploy:

bash

az deployment sub create \
  --location eastus \
  --template-file resource-group.bicep

hcl

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" { features {} }

resource "azurerm_resource_group" "lab" {
  name     = "rg-northstar-dev-001"
  location = "East US"
  tags = {
    environment = "learning"
    workload    = "northstar"
    owner       = "cloud-team"
  }
}

Pin and test the current provider version in your own repository rather than copying an old lock file.

What is a resource provider?

Microsoft.Compute, Microsoft.Storage, and Microsoft.KeyVault are namespaces. Subscriptions register providers so their resource types can be used.

bash

az provider show --namespace Microsoft.Storage --query registrationState --output tsv
az provider register --namespace Microsoft.Storage
az provider show --namespace Microsoft.Storage --expand resourceTypes --output jsonc

Registration can take time. Grant provider-registration permissions only to appropriate platform identities.

How do resource IDs work?

A typical ID is:

text

/subscriptions/{subscription
Id}/resource
Groups/{group}/providers/Microsoft.Storage/storage
Accounts/{name}

Use IDs when names are ambiguous or an API needs an exact scope. Names can be globally unique, unique within a resource group, or unique within another parent, depending on the resource type.

When should you use locks?

CanNotDelete permits changes but blocks deletion.
ReadOnly blocks management-plane changes and can break normal operations.

Portal: resource group → Locks → Add. CLI:

bash

az lock create \
  --name protect-learning-group \
  --lock-type CanNotDelete \
  --resource-group "$AZURE_RG"

Locks inherit to child resources. They do not stop data-plane operations and they are not a replacement for RBAC, backup, or policy.

Verify and clean up

bash

az group show --name "$AZURE_RG" --output jsonc
az lock list --resource-group "$AZURE_RG" --output table

Remove the lock before deleting the lab:

bash

az lock delete --name protect-learning-group --resource-group "$AZURE_RG"
az group delete --name "$AZURE_RG" --yes --no-wait

Azure Resource Manager: Resource Groups, Providers, Tags, Locks, and IDs

What is the Azure hierarchy?

How can you create a resource group?

Azure portal

Azure CLI

Azure PowerShell

Bicep

Terraform

What is a resource provider?

How do resource IDs work?

When should you use locks?

Verify and clean up

Official references

Azure Resource Manager: Resource Groups, Providers, Tags, Locks, and IDs

What is the Azure hierarchy?

How can you create a resource group?

Azure portal

Azure CLI

Azure PowerShell

Bicep

Terraform

What is a resource provider?

How do resource IDs work?

When should you use locks?

Verify and clean up

Official references