How Do You Connect to Azure Cosmos DB Without Account Keys?

Connect to Azure Cosmos DB without account keys by using a managed identity with Microsoft Entra ID and assigning it an Azure Cosmos DB data-plane RBAC role. Your application uses the account endpoint and DefaultAzureCredential to authenticate with a token instead of a key-based connection string. In this two-minute explainer, Patty Chow shows how identity-based access works for Azure Cosmos DB for NoSQL, including a point read without account keys. • Which role does your application need? Use the Azure Cosmos DB Built-in Data Reader role for reads or Built-in Data Contributor when writes are required. Scope access to the database or container the application uses. • Why isn’t the Azure Contributor role enough? Azure Contributor grants control-plane permissions to manage Azure resources. It does not grant Microsoft Entra ID access to items inside a container. That requires an Azure Cosmos DB data-plane role. • How should you configure the SDK? Create a CosmosClient with your account endpoint and DefaultAzureCredential, then reuse it throughout the application’s lifetime. • When should you disable key-based access? After every client has switched to Microsoft Entra ID, disable local authentication on the account. Speaker: Patty Chow Learn how to configure role-based access: https://learn.microsoft.com/azure/cosmos-db/how-to-connect-role-based-access-control?pivots=azure-cli #AzureCosmosDB #ManagedIdentity #RBAC #Security #Azure