Cosmos DB uses Entra ID authentication with Azure RBAC

Check ID: cosmosdb_account_use_aad_and_rbac
Provider: Azure
Service: cosmosdb
Severity: HIGH
Categories: identity-access, secrets
Resource type: microsoft.documentdb/databaseaccounts

What this check verifies

Azure Cosmos DB accounts configured to use Microsoft Entra ID with Azure RBAC by disabling key-based credentials (disableLocalAuth=true). Clients authenticate with identities rather than account keys.

Risk

With local/key-based auth enabled, long-lived account keys can be leaked or shared, enabling unauthorized reads/writes and tampering. Access bypasses MFA and granular RBAC, hindering rotation/revocation and increasing persistence and lateral movement risks.

Recommendation

Disable local authentication by setting disableLocalAuth=true and require Entra ID + Azure RBAC for control and data access. Use managed identities, apply least privilege roles, retire shared keys, and enforce zero trust with conditional access and short-lived credentials.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az resource update --resource-group <RESOURCE_GROUP> --name <COSMOS_ACCOUNT_NAME> --resource-type Microsoft.DocumentDB/databaseAccounts --set properties.disableLocalAuth=true

# Terraform: Disable local (key-based) auth on a Cosmos DB account
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  geo_location {
    location          = "<example_resource_name>"
    failover_priority = 0
  }

  local_authentication_disabled = true # Critical: Disables key-based auth to enforce Entra ID + RBAC
}

// Bicep: Disable local (key-based) auth on a Cosmos DB account
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: resourceGroup().location }]
    disableLocalAuth: true // Critical: Disables key-based auth to enforce Entra ID + Azure RBAC
  }
}

References

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-connect-role-based-access-control?pivots=azure-cli

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = cosmosdb_account_use_aad_and_rbac. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Cosmos DB firewall allows only selected networks Cosmos DB account uses private endpoint connections

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires