如何使用Azure REST API及Python移除虚拟机（VM）锁？

核心API说明 #

要移除VM关联的锁，需使用Azure的资源锁删除API，请求方式为DELETE，URL可直接复用你从列表API获取的锁id字段，补充上api-version参数即可：

DELETE https://management.azure.com{lockId}?api-version=2016-09-01

其中{lockId}就是你获取到的锁对象里的id字段值（比如/subscriptions/{SubscriptionID}/resourceGroups/{ResourceGroup}/providers/Microsoft.Compute/virtualMachines/{VMname}/providers/Microsoft.Authorization/locks/{LockName}）

Python实现步骤及代码示例 #

1. 依赖准备

先安装所需的Python库：

pip install requests azure-identity

2. 完整实现代码

import requests
from azure.identity import ClientSecretCredential

# 配置Azure认证信息（服务主体）
TENANT_ID = "你的租户ID"
CLIENT_ID = "你的客户端ID"
CLIENT_SECRET = "你的客户端密钥"
SUBSCRIPTION_ID = "你的订阅ID"
TARGET_VM_NAME = "要删除锁的VM名称"

# 获取Azure认证Token
credential = ClientSecretCredential(
    tenant_id=TENANT_ID,
    client_id=CLIENT_ID,
    client_secret=CLIENT_SECRET
)
token = credential.get_token("https://management.azure.com/.default")
auth_header = {"Authorization": f"Bearer {token.token}"}

# 1. 获取订阅下所有锁，筛选目标VM的锁
lock_list_url = f"https://management.azure.com/subscriptions/{SUBSCRIPTION_ID}/providers/Microsoft.Authorization/locks?api-version=2016-09-01"
response = requests.get(lock_list_url, headers=auth_header)
response.raise_for_status()
locks = response.json().get("value", [])

# 筛选目标VM关联的锁（匹配id中的VM名称）
target_locks = [
    lock for lock in locks
    if f"/virtualMachines/{TARGET_VM_NAME}/" in lock["id"]
]

if not target_locks:
    print(f"未找到VM {TARGET_VM_NAME}关联的锁")
    exit()

# 2. 删除每个匹配的锁
for lock in target_locks:
    delete_url = f"https://management.azure.com{lock['id']}?api-version=2016-09-01"
    delete_response = requests.delete(delete_url, headers=auth_header)
    if delete_response.status_code == 200 or delete_response.status_code == 204:
        print(f"成功删除锁：{lock['name']}")
    else:
        print(f"删除锁 {lock['name']} 失败，响应码：{delete_response.status_code}，详情：{delete_response.text}")

注意事项 #

• 权限要求：使用的服务主体或账号必须拥有Microsoft.Authorization/locks/delete权限（比如内置角色「锁管理员」）
• 分页处理：如果订阅内锁数量较多，列表API会返回nextLink字段，需要循环请求直到获取所有锁
• 错误处理：代码中加入了raise_for_status()来捕获请求错误，实际生产环境可根据需求调整异常处理逻辑
• 锁类型：不管是CanNotDelete还是ReadOnly锁，删除API的调用方式一致

内容的提问来源于stack exchange，提问作者BillyRoca