This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 20%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Hello ,
How can I enforce Role-Based Access Control (RBAC) as the only authentication method in Cosmos DB? I received this recommendation on one of my Cosmos accounts last year, and I would like to know if there are any Microsoft documentation resources that I can use to enforce this. Is disabling LocalAuth sufficient to enforce RBAC, and is this still a recommended practice?
Hi,@Sai Praneeth Eranti Thanks for posting your question in the Microsoft Q&A forum.
Here is the documentation on enforcing role-based access control as the only authentication method
https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#disable-local-auth
Regards
Geetha
Thankyou for the response . By disabling LocalAuth( enabling disableLocalAuth) will restrict to connect from Data Explorer right ? Is that a limitation ? And is this still a recommended practice?
@Sai Praneeth Eranti NO - it will disallow any connection using the primary or secondary master keys (read-only or read/write) And require AAD auth.
It is an option available - recommendations depend on your functional needs.
Regards
Geetha
@Sai Praneeth Eranti If this answers your question, please consider accepting the solution by hitting the Accept as Solution as it helps the community look for answers to similar questions. Regards
Geetha
@GeethaThatipatri-MSFT But after disabling local auth , I got this error while connecting from Data Explorer.
"Local Authorization is disabled. Use an AAD token to authorize all requests." Does DataExplorer supports RBAC ? As per the link it is not supporting . Could you please confirm ?
@Sai Praneeth Eranti Yes - you need to add above query parameter in the URI then Data Explorer should continue to work.
Regards
Geetha
@GeethaThatipatri-MSFT You mean pass the URI in Azure Cosmos DB Explorer ? or Data Explorer ?
Yes - for not supporting RBAC for Data Explorer in Azure portal ?
@GeethaThatipatri-MSFT by default cosmos.azure.com doesn't support hence you need to use https://cosmos.azure.com/?feature.enableAadDataPlane=true
portal is an administrative tool hence it has a list Keys which shows the data for that you need to have RBAC using control plane as well, combination will help you to constraint
is it still confusing?
Regards
Geetha