az lock create does not allow to set resource locks for VNet subnets

az feedback auto-generates most of the information requested below, as of CLI version

2.0.81

Describe the bug az lock create does not allow to set resource locks for VNet subnets. The following error is shown:

validation error: Parameter ‘resource_provider_namespace’ can not be None.

To Reproduce See this screenshot below - basically setting a resource lock on a VNet works, but setting a resource lock in one of it’s VNet subnets results in an error:

Expected behavior Locking a VNet subnet should be supported.

Environment summary Azure Cloud Shell (Bash) with Azure CLI 2.0.81 installed

Additional context Not sure if resource locking a VNet subnet is supported by Azure in general.

[zhoxing-ms]

@fawohlsc However, I found that there is no entry on portal to support locking subnets granular resources, please help to confirm whether this function is reasonable and needed? If so, please contact members of the portal team to add the ability to lock subnets granular resources. And I will supplement this example in the CLI help documentation.

[zhoxing-ms]

@fawohlsc Hi, if you want to lock subnets, the service needs to know which virtualNetworks the subnets belong to. There are two correct command formats:

1. az lock create --name {lock-name} --lock-type ReadOnly --resource-group {resource-group} --resource-type Microsoft.Network/virtualNetworks --resource {virtualNetwork-name}/subnets/{subnet-name}
2. az lock create --name {lock-name} --lock-type ReadOnly --resource-group {resource-group} --resource-type Microsoft.Network/subnets --parent virtualNetworks/{virtualNetwork-name} --resource {subnet-name} (more recommended)