Question

Your company uses customer-managed keys (CMK) stored in Azure Key Vault to encrypt an Azure Cosmos DB account. During a security incident review, an administrator accidentally revokes the key permissions granted to the Cosmos DB account's managed identity in the Key Vault access policy. What is the immediate impact on the Cosmos DB account, and what is the correct remediation?

Accepted Answer

The account becomes unavailable for data operations, and you must restore access by re-granting the Get, Unwrap Key, and Wrap Key permissions to the account's managed identity in Key Vault.

Answer

The account continues to function normally because Cosmos DB caches the encryption key indefinitely; no action is required.

Answer

The account is permanently corrupted and must be deleted and recreated from a periodic backup.

Answer

Only write operations fail while reads continue, and you must rotate to a new customer-managed key to restore write access.