security.yml

### YamlMime:Landing

title: Security in Azure Cosmos DB
summary: Microsoft Entra authentication using role-based access control is the **recommended** way to implement authentication in Azure Cosmos DB. There are also alternative, less recommended options for security for existing or legacy workloads.

metadata:
  title: Security overview and guidance
  titleSuffix: Azure Cosmos DB
  description: Review the various areas of consideration and techniques available where it relates to Azure Cosmos DB security.
  author: iriaosara
  ms.author: iriaosara
  ms.service: azure-cosmos-db
  ms.topic: concept-article
  ms.date: 10/02/2024
landingContent:
  - title: General guidance
    linkLists:
      - linkListType: architecture
        links:
          - text: Well Architected Framework security guidance
            url: /azure/well-architected/service-guides/cosmos-db?context=/azure/cosmos-db/context/context#security
          - text: Security baseline
            url: /security/benchmark/azure/baselines/azure-cosmos-db-security-baseline?context=/azure/cosmos-db/context/context
          - text: Security considerations
            url: security-considerations.md
  - title: Azure Cosmos DB for NoSQL
    linkLists:
      - linkListType: overview
        links:
          - text: Overview
            url: nosql/security/index.md
          - text: Glossary
            url: nosql/security/glossary.md
          - text: Frequently asked questions
            url: nosql/faq.yml#security
      - linkListType: how-to-guide
        links:
          - text: Get signed-in identity
            url: /cli/azure/ad/signed-in-user
          - text: Create managed identities
            url: /entra/identity/managed-identities-azure-resources/how-to-configure-managed-identities
          - text: Disable key-based authentication
            url: nosql/security/how-to-disable-key-based-authentication.md
          - text: Grant control plane access
            url: nosql/security/how-to-grant-control-plane-role-based-access.md
          - text: Grant data plane access
            url: nosql/security/how-to-grant-data-plane-role-based-access.md
      - linkListType: reference
        links:
          - text: Control plane `actions`
            url: /azure/role-based-access-control/permissions/databases?context=/azure/cosmos-db/nosql/security/context/context#microsoftdocumentdb
          - text: Control plane built-in roles
            url: /azure/role-based-access-control/built-in-roles?context=/azure/cosmos-db/nosql/security/context/context#databases
          - text: Data plane `dataActions`
            url: nosql/security/reference-data-plane-actions.md
  - title: Azure Cosmos DB for MongoDB (RU-based)
    linkLists:
      - linkListType: overview
        links:
          - text: Overview
            url: mongodb/security/index.md
      - linkListType: how-to-guide
        links:
          - text: Disable key-based authentication
            url: mongodb/security/how-to-disable-key-based-authentication.md
  - title: Azure Cosmos DB for Apache Cassandra (RU-based)
    linkLists:
      - linkListType: overview
        links:
          - text: Overview
            url: cassandra/security/index.md
      - linkListType: how-to-guide
        links:
          - text: Disable key-based authentication
            url: cassandra/security/how-to-disable-key-based-authentication.md
  - title: Azure Cosmos DB for Apache Gremlin
    linkLists:
      - linkListType: overview
        links:
          - text: Overview
            url: gremlin/security/index.md
      - linkListType: how-to-guide
        links:
          - text: Disable key-based authentication
            url: gremlin/security/how-to-disable-key-based-authentication.md
  - title: Azure Cosmos DB for Table
    linkLists:
      - linkListType: overview
        links:
          - text: Overview
            url: table/security/index.md
      - linkListType: how-to-guide
        links:
          - text: Disable key-based authentication
            url: table/security/how-to-disable-key-based-authentication.md
  - title: Legacy authentication methods (not recommended)
    linkLists:
      - linkListType: how-to-guide
        links:
          - text: Use resource tokens
            url: /previous-versions/azure/cosmos-db/how-to-use-resource-tokens
          - text: Use primary and secondary keys
            url: /previous-versions/azure/cosmos-db/how-to-obtain-keys
          - text: Implement key rotation
            url: /previous-versions/azure/cosmos-db/how-to-implement-key-rotation