An administrator configures a monthly budget of $5,000 for a resource group named rg-experimental-workloads. To prevent unauthorized changes to the resource group's configuration, the administrator applies a ReadOnly resource lock to rg-experimental-workloads. A budget alert is configured at a 90% threshold to trigger an Azure Automation runbook via an Action Group to deallocate all running virtual machines (VMs) in the resource group. When the budget threshold is reached, the alert fires, but the VMs remain running and continue to incur costs. What is the cause of this issue?
- The ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action.Answer
- BReadOnly locks are not inherited by the virtual machines within the resource group, requiring the lock to be applied to each virtual machine individually.
- CThe Automation runbook is blocked because the Service Principal executing it requires a Deny assignment at the resource group level to override the resource lock.
- DBudget alerts configured at the resource group scope can only send email notifications and do not support Action Groups.
Answer
The ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action.
The correct answer is that the ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action. A ReadOnly lock blocks any actions that modify the resource state, which includes VM power operations such as stopping or deallocating.
Step-by-Step Solution
Key Concept
Resource lock inheritance and its impact on virtual machine management tasks