Azure Resource Lock Auditor

Overview

This flow enforces Azure resource-lock hygiene. On a daily schedule it inspects every resource group in a subscription through Azure Resource Manager (ARM), flags any group that does not carry a management lock, records each unprotected group as a finding in Dataverse, alerts the platform team in Microsoft Teams, and can optionally re-apply a default lock (auto-remediation, off by default).

Why it matters: A missing CanNotDelete lock on a production resource group is a deletion waiting to happen. A daily audit — with an optional one-switch remediation — closes that gap before someone fat-fingers a delete.

As-built note: Azure Resource Manager has no first-class Power Automate connector action wired up in this environment, so ARM is called with the built-in HTTP action using `ActiveDirectoryOAuth` — the sanctioned connector-first exception for non-connectorized REST APIs (§4b case 2). Dataverse and Teams use their standard connector actions. The flow ships Off; going live requires only authorizing the two connections and populating the eight environment variables.

Use Case

A platform / cloud-governance team mandates delete-locks on protected resources and wants continuous, automated verification that they are present — plus an optional break-glass switch to re-apply a default lock on anything found unprotected. Audience: IT Admins, Operations.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Scope the audit

Point flowlibs_AzureSubscriptionId at the target subscription. To audit several, clone the flow or wrap the two HTTP calls in a Foreach over a subscription list.

Lock level by tier

Set flowlibs_RequiredLockLevel to ReadOnly for stricter groups, or branch on RG tags to require different levels per tier.

Enable auto-remediation

Set varAutoReapplyLock to "true" (and grant the SP locks/write) to have the flow PUT a default lock on any unprotected RG.

Approval before apply

Insert an Approvals StartAndWaitForAnApproval before HTTP Apply Default Lock to gate remediation.

Resource-level locks

Extend the ARM calls to enumerate key data stores (storage accounts, SQL) and check their locks, not just resource groups.

Coverage report

Add a weekly summary reading the findings table for a % protected metric.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@equals(length(body('Filter_Locks_For_This_Rg')), 0)

@startsWith(toLower(item()?['id']), toLower(concat(items('Apply_to_each_Resource_Group')?['id'], '/providers/microsoft.authorization/locks/')))

@{concat(variables('varArmBase'),'/subscriptions/',variables('varSubscriptionId'),'/resourcegroups?api-version=',variables('varRgApiVersion'))}

@{concat(variables('varArmBase'),'/')}

@{concat(variables('varArmBase'), items('Apply_to_each_Resource_Group')?['id'], '/providers/Microsoft.Authorization/locks/flowlibs-default-lock?api-version=', variables('varLocksApiVersion'))}

@greater(variables('varFindingsCount'), 0)

Customize & download