docs(acr purge): document --include-locked parameter (acr-cli ≥ 0.17)

articles/container-registry/container-registry-auto-purge.md

@@ -6,7 +6,7 @@ ms.service: azure-container-registry
 ms.custom: devx-track-azurecli
 author: KumudD
 ms.author: kumud
-ms.date: 02/26/2026
+ms.date: 07/08/2026
 # Customer intent: As a developer, I want to efficiently purge old or unnecessary images from my container registry, so that I can maintain an organized and optimally performing storage environment.
 ---
 
@@ -34,7 +34,7 @@ To delete single image tags or manifests by using Azure CLI commands, see [Delet
 The `acr purge` command deletes images by tag in a repository. It deletes all images that match a name filter and are older than a specified duration. By default, the command deletes only tag references, not the underlying [manifests](container-registry-concepts.md#manifest) and layer data. The command has an option to also delete manifests.
 
 > [!NOTE]
-> `acr purge` doesn't delete an image tag or repository if the `write-enabled` attribute is set to `false`. For more information, see [Lock a container image in an Azure container registry](container-registry-image-lock.md).
+> By default, `acr purge` doesn't delete an image tag or manifest if the `write-enabled` or `delete-enabled` attribute is set to `false`. To also purge these locked artifacts, use the `--include-locked` parameter, which unlocks each matching tag or manifest before deleting it. For more information, see [Lock a container image in an Azure container registry](container-registry-image-lock.md).
 
 `acr purge` is designed to run as a container command in an [ACR Task](container-registry-tasks-overview.md). It automatically authenticates with the registry where the task runs and performs actions there. The task examples in this article use the `acr purge` command [alias](container-registry-tasks-reference-yaml.md#aliases) instead of a fully qualified container image command.
 
@@ -59,6 +59,10 @@ At a minimum, specify the following options when you run `acr purge`:
 * `--keep` - Specifies the latest number of to-be-deleted tags per repository that are retained. The latest tags are determined by the last modified time of the tag for each repository matched by the provided `--filter` options.
 * `--concurrency` - Specifies a number of purge tasks to process concurrently.
 * `--untagged-only` - Deletes only untagged manifests (dangling manifests that have no tags) without deleting any tags first. Unlike the standard `acr purge` flow, which requires `--filter` and `--ago`, this flag makes those parameters optional. Without `--filter`, it scans all repositories. You can combine it with `--ago` to filter by age and `--keep` to preserve a number of recent untagged manifests.
+* `--include-locked` - Purges tags and manifests even when they're locked (that is, their `write-enabled` or `delete-enabled` attributes are set to `false`). For each matching locked artifact, `acr purge` first unlocks it by setting both attributes back to `true`, then deletes it. Without this flag, locked tags and manifests are skipped. This parameter is available beginning with `mcr.microsoft.com/acr/acr-cli:0.17`. For more information about locking, see [Lock a container image in an Azure container registry](container-registry-image-lock.md).
+
+> [!CAUTION]
+> `--include-locked` overrides the deletion protection provided by [locking](container-registry-image-lock.md) and applies to every artifact matching your `--filter` and `--ago` selection. Deleted data is **unrecoverable**. Run with `--dry-run` first to confirm what will be removed.
 
 For information about additional parameters, run `acr purge --help`.
 

articles/container-registry/container-registry-image-lock.md

@@ -6,7 +6,7 @@ ms.custom: devx-track-azurecli
 author: KumudD
 ms.author: kumud
 ms.service: azure-container-registry
-ms.date: 10/31/2023
+ms.date: 07/08/2026
 # Customer intent: As a developer, I want to lock container images in a registry so that they cannot be deleted or overwritten, ensuring the integrity of production deployments.
 ---
 
@@ -198,6 +198,9 @@ az acr repository update \
    --delete-enabled true --write-enabled true
 ```
 
+> [!NOTE]
+> If it has sufficient permissions, the `acr purge` command can unlock locked artifacts automatically. When run with the `--include-locked` parameter, it resets `delete-enabled` and `write-enabled` to `true` on each matching locked tag or manifest before deleting it. For more information, see [Automatically purge images from an Azure container registry](container-registry-auto-purge.md).
+
 ## Next steps
 
 In this article, you learned about using the [az acr repository update][az-acr-repository-update] command to prevent deletion or updating of image versions in a repository. To set additional attributes, see the [az acr repository update][az-acr-repository-update] command reference.