Which control should a manager apply to prevent a VM from being accidentally deleted or modified?

Resource Locks prevent accidental deletion or modification of Azure resources. Applying a "CanNotDelete" lock prevents deletion, while a "ReadOnly" lock prevents both deletion and modification. This is crucial for critical resources like VMs to ensure business continuity. Azure Tags are for organizing and categorizing resources, not for preventing changes. Activity Logs record events that occurred on resources, useful for auditing, but they don't prevent actions. Role Assignments manage who has access to perform actions, but a user with delete permissions could still accidentally delete a resource if no lock is present.