Question

A security team wants operations engineers to be able to create and modify Azure Cosmos DB accounts, adjust throughput settings, and manage failover priorities through the Azure portal and ARM, but they must be prevented from reading or writing any document data inside containers. Which approach satisfies these requirements with the least privilege?

Accepted Answer

Assign the engineers a control-plane Azure RBAC role such as Cosmos DB Operator, and do not grant any Cosmos DB data-plane role assignments.

Answer

Assign the engineers the Cosmos DB Built-in Data Contributor data-plane role scoped to the account.

Answer

Distribute the account's primary read-write key to the engineers so they can manage the account.

Answer

Assign the engineers the Owner role on the resource group containing the Cosmos DB account.