# Ensure CosmosDB uses AAD client authentication or RBAC where possible

- Source: https://support.icompaas.com/support/solutions/articles/62000229904-ensure-cosmosdb-uses-aad-client-authentication-or-rbac-where-possible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure Active Directory (now Microsoft Entra ID) provides identity-based authentication and Role-Based Access Control (RBAC) for managing access to Azure resources and services. Replacing traditional shared keys, usernames, or passwords with Entra ID identities significantly improves security by enabling centralized authentication, conditional access, MFA enforcement, and granular role assignments. Using Entra ID for client authentication ensures modern, secure, and auditable access patterns for Azure services such as Key Vault, Storage Accounts, SQL Database, and Azure Kubernetes Service.

  

Rationale:

Identity-based authentication greatly reduces the risks associated with shared credentials, static access keys, and connection strings. Azure RBAC offers least-privilege access control and improves auditability across services. Enabling Entra ID authentication ensures stronger security, better onboarding/offboarding, compliance enforcement, and alignment with Zero Trust and cloud governance best practices.

  

Impact:

Adopting AAD/Entra authentication increases security and reduces credential exposure but may require application updates to support identity-based access and may require additional configuration of roles and permissions.

  

Default Value:

Many Azure services default to using access keys or SQL logins unless Entra ID authentication is explicitly configured.

  

Pre-Requisites:

-   Microsoft Entra ID tenant
    
-   Appropriate Azure RBAC roles assigned (for example: Reader, Contributor, Key Vault Secrets User, Storage Blob Data Contributor)
    
-   Applications or services must support Entra ID authentication
    
-   Admin access to configure authentication settings
    

  

## Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for and open the target resource (for example, Azure Cosmos DB)
    
3.  From the left menu, select Access control (IAM)
    
4.  Open Role assignments
    
5.  Verify users, groups, or managed identities are assigned Azure RBAC roles (such as Reader, Contributor, or Owner)
    
6.  Confirm access is granted through Azure AD identities and not through account keys or connection strings
    
7.  If RBAC-based access is not configured, follow the implementation steps
    

![](https://support.icompaas.com/assets/kb/520768a23e9ac275.png)

## Implementation Steps:

1.  Sign in to the Azure Portal
    
2.  Open the target Azure resource
    
3.  Select Access control (IAM)
    
4.  Click Add, Add role assignment
    

![](https://support.icompaas.com/assets/kb/da0a4656852d9ceb.png)

5.  Select an appropriate Azure built-in role (Owner, Contributor, Reader, or required role)
    
6.  Assign the role to a user, group, or application from Microsoft Entra ID
    
7.  Save the role assignment
    

  

Backout Plan:

1.  Sign in to the Azure Portal
    
2.  Open the target Azure resource
    
3.  Select Access control (IAM)
    
4.  Locate the role assignment
    
5.  Remove the Azure RBAC role from the user, group, or application
    
6.  Save the changes
    

  

Reference:

-   [https://learn.microsoft.com/azure/active-directory](https://learn.microsoft.com/azure/active-directory)
    
-   [https://learn.microsoft.com/azure/role-based-access-control/overview](https://learn.microsoft.com/azure/active-directory)
    
-   [https://learn.microsoft.com/azure/key-vault/general/rbac-guide](https://learn.microsoft.com/azure/active-directory)
    
-   [https://learn.microsoft.com/azure/storage/common/storage-auth-aad](https://learn.microsoft.com/azure/active-directory)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.