diff --git a/azurerm/internal/services/iothub/iothub_consumer_group_resource.go b/azurerm/internal/services/iothub/iothub_consumer_group_resource.go
index 4c99cecd2ca1..02850f103e05 100644
--- a/azurerm/internal/services/iothub/iothub_consumer_group_resource.go
+++ b/azurerm/internal/services/iothub/iothub_consumer_group_resource.go
@@ -11,6 +11,7 @@ import (
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/validate"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/features"
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/locks"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/timeouts"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils"
 )
@@ -68,6 +69,9 @@ func resourceArmIotHubConsumerGroupCreate(d *schema.ResourceData, meta interface
 	endpointName := d.Get("eventhub_endpoint_name").(string)
 	resourceGroup := d.Get("resource_group_name").(string)
 
+	locks.ByName(iotHubName, IothubResourceName)
+	defer locks.UnlockByName(iotHubName, IothubResourceName)
+
 	if features.ShouldResourcesBeImported() && d.IsNewResource() {
 		existing, err := client.GetEventHubConsumerGroup(ctx, resourceGroup, iotHubName, endpointName, name)
 		if err != nil {
@@ -145,6 +149,9 @@ func resourceArmIotHubConsumerGroupDelete(d *schema.ResourceData, meta interface
 	endpointName := id.Path["eventHubEndpoints"]
 	name := id.Path["ConsumerGroups"]
 
+	locks.ByName(iotHubName, IothubResourceName)
+	defer locks.UnlockByName(iotHubName, IothubResourceName)
+
 	resp, err := client.DeleteEventHubConsumerGroup(ctx, resourceGroup, iotHubName, endpointName, name)
 
 	if err != nil {
diff --git a/azurerm/internal/services/iothub/tests/iothub_consumer_group_resource_test.go b/azurerm/internal/services/iothub/tests/iothub_consumer_group_resource_test.go
index b24365044e68..d8b123457560 100644
--- a/azurerm/internal/services/iothub/tests/iothub_consumer_group_resource_test.go
+++ b/azurerm/internal/services/iothub/tests/iothub_consumer_group_resource_test.go
@@ -73,6 +73,25 @@ func TestAccAzureRMIotHubConsumerGroup_operationsMonitoringEvents(t *testing.T)
 	})
 }
 
+func TestAccAzureRMIotHubConsumerGroup_withSharedAccessPolicy(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_iothub_consumer_group", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMIotHubConsumerGroupDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMIotHubConsumerGroup_withSharedAccessPolicy(data, "events"),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMIotHubConsumerGroupExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
 func testCheckAzureRMIotHubConsumerGroupDestroy(s *terraform.State) error {
 	client := acceptance.AzureProvider.Meta().(*clients.Client).IoTHub.ResourceClient
 	ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
@@ -176,3 +195,17 @@ resource "azurerm_iothub_consumer_group" "import" {
 }
 `, template)
 }
+
+func testAccAzureRMIotHubConsumerGroup_withSharedAccessPolicy(data acceptance.TestData, eventName string) string {
+	template := testAccAzureRMIotHubConsumerGroup_basic(data, eventName)
+	return fmt.Sprintf(`
+%s
+
+resource "azurerm_iothub_shared_access_policy" "test" {
+  name                = "acctestSharedAccessPolicy"
+  resource_group_name = azurerm_resource_group.test.name
+  iothub_name         = azurerm_iothub.test.name
+  service_connect     = true
+}
+`, template)
+}