1. Azure Locks can be applied at resource, resource group or subscription level
   2. No lock at management group level
2. inherited
   1. all child resources get the same lock
3. Types:
   1. Ready Only - can not delete or update anything / similar to reader role
   2. Delete - can read/modify but can not delete a resource

references:

Lock resources