A company has a single Azure subscription on resources are deployed. There is a resource group where company's production resources are created. That resource group is called production-rg. There is…

Removing the development team from the Contributor role and assigning them the Reader role would prevent all configuration changes, not just deletions, which contradicts the requirement for them to make regular changes.

A ReadOnly lock prevents all write operations, including configuration changes, which would prevent the development team from performing their testing and making necessary modifications.

A CanNotDelete Azure resource lock prevents any user, regardless of their Azure RBAC permissions like Contributor, from deleting the locked resource or any resources within a locked scope like a resource group, while still permitting all other read and modify operations.

Creating a custom role that *contains* the delete operation does not prevent deletion; to prevent deletion using roles, you would remove the delete operation, but an Azure lock is a more direct and effective way to prevent deletion across all users, overriding RBAC delete permissions.