Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)
Evaluates each Azure Cosmos DB account to determine whether its Access Control is configured to use Azure Active Directory (AAD) identities together with Role-Based Access Control (RBAC) for authorizing requests to the account.
With local/key-based auth enabled, long-lived account keys can be leaked or shared, enabling unauthorized reads/writes and tampering. Access bypasses MFA and granular RBAC, hindering rotation/revocation and increasing persistence and lateral movement risks.
What this control checks
Cosmos DB accounts must use Azure AD and RBAC for access control
Common pitfalls
Mongo, Cassandra and Gremlin accounts are excluded
The policy rule only applies when Microsoft.DocumentDB/databaseAccounts/capabilities[*].name is not in EnableMongo, EnableCassandra, EnableGremlin.
Modify only applies from API version 2021-06-15
The addOrReplace operation on Microsoft.DocumentDB/databaseAccounts/disableLocalAuth has the condition [greaterOrEquals(requestContext().apiVersion, '2021-06-15')].
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Cosmos DB database accounts should have local authentication methods disabled" (5450f5bd-9c72-4390-a9c4-a7aba4edfdd2) and "Configure Cosmos DB database accounts to disable local authentication" (dc2d41d1-4ab1-4666-a3e1-3d51c43e0049); Prowler check cosmosdb_account_use_aad_and_rbac (prowler azure --checks cosmosdb_account_use_aad_and_rbac); PowerPipe control azure_compliance.control.cosmosdb_account_uses_aad_and_rbac.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 4.5.3 Use Azure Active Directory (AAD) Client Authentication and Azure RBAC where possible.
- 4.5.3 Use Entra ID Client Authentication and Azure RBAC where possible.
- 5.4.3 Use Entra ID Client Authentication and Azure RBAC where possible
- 164.308(a)(4)(ii)(B) Access authorization
- 164.312(a)(2)(i) Unique user identification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_uses_aad_and_rbac - Powerpipe Control:
azure_compliance.control.cosmosdb_account_uses_aad_and_rbac - Prowler Check:
cosmosdb_account_use_aad_and_rbac - Azure Policy Definitions:
5450f5bd-9c72-4390-a9c4-a7aba4edfdd2,dc2d41d1-4ab1-4666-a3e1-3d51c43e0049
Last reviewed: 2026-10-11