Azure-cli: [ResourceManager] Unable to delete locks

[berndverst]

az lock delete --name $LOCKNAME does not return any value and seems to have no impact

My specific use case:
I am unable to delete or update a lock associate with a storage account which itself was associated with a function app. I want to delete the storage account after having deleted a function app via CLI.

There appears to be no workaround since the Portal no longer gives me access to the function settings (and locks).

Steps to reproduce:

az appservice web delete --name shortlinkservice --resource-group shortlinkservice-group

az storage account delete --name function92f1a43683ee --resource-group shortlinkservice-group
Are you sure you want to perform this operation? (y/n): y
The scope '/subscriptions/203c6e23-7c41-47de-8f9f-2ad1807ae229/resourceGroups/shortlinkservice-group/providers/Microsoft.Storage/storageAccounts/function92f1a43683ee' cannot perform delete operation because following scope(s) are locked: '/subscriptions/203c6e23-7c41-47de-8f9f-2ad1807ae229/resourcegroups/shortlinkservice-group/providers/Microsoft.Storage/storageAccounts/function92f1a43683ee'. Please remove the lock and try again.

az lock list
[
  {
    "id": "/subscriptions/203c6e23-7c41-47de-8f9f-2ad1807ae229/resourcegroups/shortlinkservice-group/providers/Microsoft.Storage/storageAccounts/function92f1a43683ee/providers/Microsoft.Authorization/locks/function92f1a43683ee",
    "level": "CanNotDelete",
    "name": "function92f1a43683ee",
    "notes": "One or more function apps were linked to this storage account. You can see all the function apps linked to the account under 'files' or 'shares'.",
    "type": "Microsoft.Authorization/locks"
  }
]

az lock delete --name function92f1a43683ee

(no return value or error)

az lock list
[
  {
    "id": "/subscriptions/203c6e23-7c41-47de-8f9f-2ad1807ae229/resourcegroups/shortlinkservice-group/providers/Microsoft.Storage/storageAccounts/function92f1a43683ee/providers/Microsoft.Authorization/locks/function92f1a43683ee",
    "level": "CanNotDelete",
    "name": "function92f1a43683ee",
    "notes": "One or more function apps were linked to this storage account. You can see all the function apps linked to the account under 'files' or 'shares'.",
    "type": "Microsoft.Authorization/locks"
  }
]

az lock update --name function92f1a436833ee
The lock 'function92f1a436833ee' could not be found.

Stuck.

[tjprescott]

Thanks for the report @berndverst. In investigating this issue I found there are a number of deficiencies with the az lock commands. See issue #2694. I will continue to investigate this, but if you see additional deficiencies, please add them as comments to that issue.

[tjprescott]

@berndverst, since the lock is on the storage account, even though you can't access the deleted function app, you should be able to access and delete the lock on the storage account in the portal.

[brendandburns]

@berndverst

The lock is defined at the resource level, so the correct invocation would be:

az lock delete --resource-group=shortlinkservice-group --resource-type=Microsoft.Storage/storageAccounts --resource-name=function92f1a43683ee --name=function92f1a43683ee

I'll think about ways to make this more clear in the CLI when a user tries to delete something at the wrong level.

[brendandburns]

See:

https://github.com/Azure/azure-cli/issues/2688

For some improvements in the UX that would lead you toward figuring out the right invocation on your own.

[berndverst]

@brendandburns

This did the trick. Had to drop the --resource-name param.

az lock delete --resource-group=shortlinkservice-group --resource-type=Microsoft.Storage/storageAccounts --name=function92f1a43683ee

[berndverst]

@tjprescott
Ah, how / where the lock on the storage account was being managed wasn't clear to me from the portal nor from the CLI. The CLI responses certainly weren't helpful here.

I had tried deleting the storage account from the portal where it informed that it couldn't be completed (because of a lock, but it showed a rather cryptic error). Unfortunately it didn't guide me towards any place where I could find and delete the lock in the portal.

[johnpapa]

I had similar problems. However I had to include the resource type, name, resource group and resource name flags to remove the lock.

az lock delete --name functione79b3418af65 --resource-group papaResourceGroup --resource-type=Microsoft.Storage/storageAccounts --resource-name functione79b3418af65

[brendandburns]

I'm closing this for now since I believe the original confusion has been addressed as best we can for now.