TopolearnUnderstanding ARM explains why every tool behaves the same and how to protect and label resources.
Every request to create, change or delete a resource, whether from the portal, CLI, PowerShell, SDK or Bicep, goes through Azure Resource Manager (ARM). ARM authenticates you with Entra ID, checks RBAC and Azure Policy, then forwards the request to a resource provider such as Microsoft.Storage or Microsoft.Web.
Every resource has a resource ID:
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{name}
The ID encodes the provider namespace and type, and it is what you pass as --scope for role assignments, policies and locks. Each provider must be registered in a subscription before use; most are registered automatically, but a "MissingSubscriptionRegistration" error means running az provider register.
Tags are name/value pairs (env=prod, costCenter=1234) used for cost reporting and automation. Tags are not inherited from resource groups by default; Azure Policy can enforce or copy them.
Locks guard against accidents: CanNotDelete allows changes but blocks deletion, ReadOnly blocks all writes. Locks apply to everyone, including Owners, and inherit downward. Note that ReadOnly can break things unexpectedly, because some read-like operations (such as listing storage keys) are POST requests that the lock blocks.
Example
az provider show -n Microsoft.App --query registrationState -o tsv # NotRegistered
az provider register -n Microsoft.App
az resource tag --is-incremental --tags env=prod costCenter=1234 \
--ids /subscriptions/$SUB/resourceGroups/rg-prod/providers/Microsoft.Storage/storageAccounts/stprod01
# Find everything tagged env=prod
az resource list --tag env=prod --query "[].name" -o tsv
# Nobody, not even an Owner, can delete the group until the lock is removed
az lock create --name no-delete --lock-type CanNotDelete --resource-group rg-prodRemember
- Portal, CLI, SDKs and Bicep all call the same ARM API
- Resource IDs encode subscription, group, provider, type and name
- Tags label resources for cost and automation; they are not inherited by default
- CanNotDelete and ReadOnly locks apply even to Owners
Watch out for
- Using
az resource tagwithout--is-incremental, which replaces all existing tags instead of adding to them.