Question

Your company's compliance team requires that all encryption keys for an Azure Cosmos DB account be managed and rotated by your organization rather than by Microsoft. You plan to configure the account to use customer-managed keys (CMK) stored in Azure Key Vault. Which combination of settings is REQUIRED on the Key Vault so that Cosmos DB can use the key and so that accidental deletion does not permanently lock you out of your data?

Accepted Answer

Enable soft delete and purge protection on the Key Vault, and grant the Cosmos DB identity Get, Unwrap Key, and Wrap Key permissions.

Answer

Enable only soft delete on the Key Vault, and grant the Cosmos DB identity full administrator access to all keys, secrets, and certificates.

Answer

Disable soft delete but enable purge protection, and grant the Cosmos DB identity Sign and Verify permissions on the key.

Answer

Enable purge protection only, and grant the Cosmos DB identity Decrypt and Encrypt permissions at the secret scope.