How to Administratively Lock or Unlock a Network Fabric in Azure

This guide explains how to use the Administrative Lock feature introduced in NNF 8.2 to lock or unlock a fabric resource in Azure. The lock prevents any configuration changes while still allowing safe read operations. This feature is available for both existing and new deployments.

The Administrative Lock feature provides a mechanism to control write and update operations to your Network Fabric environment. When locked, the fabric rejects all Create, Update, and Delete (CUD) operations, ensuring configuration integrity during critical events such as maintenance, incident response, or staged deployments.

Key Behaviors

• When locked, all configuration changes are blocked—including those initiated by the user or the Azure service.
• The current lock status is visible on the Fabric resource under the Fabric Lock Properties block.
• The lock can be toggled via a POST action using ARM APIs or Azure CLI.

Prerequisites

• Azure CLI version 8.0.0b3 or later is installed.

Check Current Fabric Lock Status

Before applying or removing an administrative lock, you can query the current lock status of your fabric using the following CLI command:

az networkfabric fabric show \
  -g <resource-group-name> \
  --resource-name <fabric-name> \
  --query "fabricLocks[?lockType=='Administrative'].{Type:lockType,State:lockState}" \
  -o table

Parameters:

• -g or --resource-group: Name of the resource group containing the fabric.
• --resource-name: Name of your Network Fabric resource.
• --query: Filters the output to show only Administrative lock type and its current state.
• -o table: Formats the output as a table for better readability.

Example

az networkfabric fabric show \
  -g nf-rg-prod \
  --resource-name nf-eastus-prod \
  --query "fabricLocks[?lockType=='Administrative'].{Type:lockType,State:lockState}" \
  -o table

This command will display the current administrative lock status (Locked or Unlocked) for the specified fabric.

How to Use the Azure CLI to Lock or Unlock a Fabric

You can apply or remove the administrative lock using the following CLI command:

az networkfabric fabric lock-fabric \
  --action {Lock | Unlock} \
  --lock-type Administrative \
  --network-fabric-name <fabric-name> \
  --resource-group <resource-group-name>

Parameters:

• --action: Specify Lock or Unlock to change the fabric's state.
• --lock-type: Set to Administrative.
• --network-fabric-name: Name of your Network Fabric resource.
• --resource-group: (Optional) Name of the resource group containing the fabric.

Example

az networkfabric fabric lock-fabric \
  --action Lock \
  --lock-type Administrative \
  --network-fabric-name nf-eastus-prod \
  --resource-group nf-rg-prod

This command will place the fabric in a locked state, preventing any configuration changes.

Supported and unsupported actions post administrative lock