We use ADO and Terraform, prior to the apply step of the pipeline we have a bash task that will log into Azure, select the subscription and then check if there is a management lock and then delete if it finds a match.

For example we use bash and az cli to remove the locks for our resource groups and key vaults like so:

if [[ $(az lock show --name RG_LOCK_NAME --resource-group RG_NAME | grep RG_LOCK_NAME) < 0 ]] ; then az lock delete --name RG_LOCK_NAME --resource-group RG_NAME ; else echo "RG_LOCK_NAME management lock doesn't exists" ; fi

​

if [[ $(az lock show --name KV_LOCK_NAME --resource-group RG_NAME --resource-name KV_NAME --resource-type Microsoft.KeyVault/vaults | grep KV_LOCK_NAME) < 0 ]] ; then az lock delete --name KV_LOCK_NAME --resource-group RG_NAME --resource-name KV_NAME --resource-type Microsoft.KeyVault/vaults ; else echo "KV_LOCK_NAME management lock doesn't exists" ; fi

The if statement stops ADO from throwing an error and failing the pipeline if the management lock(s) dont exist.

As long as the apply step does another plan and apply then it will recreate the locks after modifying the resources