Can I require managed identites on a CosmosAccount via CLI/PowerShell/Portal

Question

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#disable-local-auth
Shows how to disable keys from an ARM template.

Can this be done for an existing cosmos not created with ARM. Either from CLI, Powershell, or Portal.

QA Assist answer appears to be how to make the Cosmos Account USE a managed identity, not how to require a managed identity to access the account.

Answer 1

@******@gmail.com This is still not supported from CLI yet, you can check the below forum on SO, however I will confirm from the product team and get back on this.

https://stackoverflow.com/questions/70849701/disable-local-authentication-methods-for-cosmos-db-database-accounts-using-azure/71918804#71918804

Regards

Geetha

Answer 2

Yes, you can require managed identities on a CosmosAccount via CLI, PowerShell, or the Portal. To do this, you need to enable a system-assigned managed identity on your account and then use it to grant access to your Azure Key Vault account. Here are the steps:

1. If the system-assigned managed identity wasn't configured during account creation, enable a system-assigned managed identity on your account and copy the principalId that got assigned.
2. Add the correspondent permissions to your Azure Key Vault account as described previously. Instead of using the Cosmos DB principal, use the principalId you copied at the previous step instead of Azure Cosmos DB's first-party identity.
3. Update your Azure Cosmos DB account to specify that you want to use the system-assigned managed identity when accessing your encryption keys in Azure Key Vault.

You can use the Azure CLI to assign a managed identity to an access policy. Here's an example command:

# Variables for resource group and account names
resourceGroupName="<resource-group-name>"
accountName="<azure-cosmos-db-account-name>"
az cosmosdb update \
--resource-group $resourceGroupName \
--name $accountName \
--default-identity "SystemAssignedIdentity"

You can also use Azure PowerShell to assign a managed identity to an access policy. Here's an example command:

Update-AzCosmosDBAccount -ResourceGroupName [ResourceGroupName] -Name [CosmosDBAccountName] -DefaultIdentity "SystemAssignedIdentity"

Alternatively, you can use the Azure portal to enable a managed identity and grant it access to your Azure Key Vault account. Once you have done this, you can use the managed identity to access your encryption keys in Azure Key Vault.

---

References:

• Configure customer-managed keys for your Azure Cosmos DB account with Azure Key Vault
• Azure role-based access control in Azure Cosmos DB