Question

A financial services company requires that all access to a Cosmos DB for NoSQL account be auditable and that primary/secondary account keys never be used by applications reading and writing documents. Developers must authenticate using Microsoft Entra ID identities, and each application's ability to read or write items must be governed by role assignments. Which approach satisfies these requirements for data-plane operations?

Accepted Answer

Assign the built-in 'Cosmos DB Built-in Data Contributor' role to the application's Entra ID identity using the Cosmos DB native RBAC data-plane role definitions.

Answer

Assign the Azure control-plane role 'DocumentDB Account Contributor' to the application identity so it can read and write items.

Answer

Store the primary key in Azure Key Vault and grant the application a Key Vault access policy so it can retrieve the key at runtime.

Answer

Enable customer-managed keys (CMK) with Key Vault so all item reads and writes are authorized through Entra ID.