---
title: "Creates or updates a management lock at the subscription level."
method: PUT
path: "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/locks/{lockName}"
tags: ["ManagementLocks"]
---

# Creates or updates a management lock at the subscription level.

`PUT /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/locks/{lockName}`

When you apply a lock at a parent scope, all child resources inherit the same lock. To create management locks, you must have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Of the built-in roles, only Owner and User Access Administrator are granted those actions.

## Path parameters

- `lockName` string, required
- `subscriptionId` string, required

## Query parameters

- `api-version` string, required

## Request body

- ManagementLockObject — The lock information.
  - `properties` ManagementLockProperties, required — The lock properties.
    - `level` 'NotSpecified' | 'CanNotDelete' | 'ReadOnly', required — The level of the lock. Possible values are: NotSpecified, CanNotDelete, ReadOnly. CanNotDelete means authorized users are able to read and modify the resources, but not delete. ReadOnly means authorized users can only read from a resource, but they can't modify or delete it.
    - `notes` string — Notes about the lock. Maximum of 512 characters.
    - `owners` ManagementLockOwner[] — The owners of the lock.
      - `applicationId` string — The application ID of the lock owner.
  - `id` string — The resource ID of the lock.
  - `type` string — The resource type of the lock - Microsoft.Authorization/locks.
  - `name` string — The name of the lock.

## Response `200`

OK - Returns information about the lock.

- ManagementLockObject — The lock information.
  - `properties` ManagementLockProperties, required — The lock properties.
    - `level` 'NotSpecified' | 'CanNotDelete' | 'ReadOnly', required — The level of the lock. Possible values are: NotSpecified, CanNotDelete, ReadOnly. CanNotDelete means authorized users are able to read and modify the resources, but not delete. ReadOnly means authorized users can only read from a resource, but they can't modify or delete it.
    - `notes` string — Notes about the lock. Maximum of 512 characters.
    - `owners` ManagementLockOwner[] — The owners of the lock.
      - `applicationId` string — The application ID of the lock owner.
  - `id` string — The resource ID of the lock.
  - `type` string — The resource type of the lock - Microsoft.Authorization/locks.
  - `name` string — The name of the lock.

## Other responses

- `201` — Created - Returns information about the lock.

---

[API](https://skmtc.net/azure/apis/managementlockclient.md) · [All operations](https://skmtc.net/azure/apis/managementlockclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/managementlockclient/versions/f7fac92f6c97/schema)