Question

A development team runs an ASP.NET Core web app on Azure App Service that connects to Azure Cosmos DB. Security auditors flag that the account's primary key is stored in an App Service application setting. The team must remove all shared keys from configuration and authenticate using Microsoft Entra ID, while granting the app only the ability to read and write items in a single container (no control-plane management rights). What should the team implement?

Accepted Answer

Assign a system-assigned managed identity to the App Service, then use the Cosmos DB data plane RBAC to assign a built-in or custom role scoped to the container, and connect the SDK with TokenCredential.

Answer

Assign the built-in Azure RBAC 'Cosmos DB Account Reader' control-plane role to the App Service managed identity and connect using DefaultAzureCredential.

Answer

Rotate to the secondary key and store it in Azure Key Vault, referencing it from App Service configuration with a Key Vault reference.

Answer

Enable Always Encrypted with a customer-managed key so the SDK no longer needs the account key to read data.