{"id":12589,"date":"2026-06-25T06:00:50","date_gmt":"2026-06-25T13:00:50","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cosmosdb\/?p=12589"},"modified":"2026-06-24T09:08:49","modified_gmt":"2026-06-24T16:08:49","slug":"which-azure-cosmos-db-role-does-my-app-need","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cosmosdb\/which-azure-cosmos-db-role-does-my-app-need\/","title":{"rendered":"Which Azure Cosmos DB Role Does My App Need?"},"content":{"rendered":"

In the previous post in the series, we covered the security decisions you make on day one<\/a>. In this part, we will talk about how to give your app access to Cosmos DB data, using roles and a managed identity instead of keys.<\/em><\/p>\n

The situation<\/strong><\/h2>\n

You\u2019ve built your app. It works locally. Now you\u2019re ready to connect it to Azure Cosmos DB, and you hit the question: how does my app get access? There are really only three questions you need to answer:<\/p>\n

    \n
  1. Who<\/strong>\u00a0is asking for access? (your app’s identity)<\/li>\n
  2. What<\/strong>\u00a0are they allowed to do? (a role)<\/li>\n
  3. Where<\/strong>\u00a0does that permission apply? (a scope)<\/li>\n<\/ol>\n

     <\/p>\n

    \"Illustrated<\/a><\/p>\n

    First, the one distinction that trips everyone up<\/strong><\/h2>\n

    Cosmos DB has two completely separate permission systems. If you remember nothing else from this post, remember this:<\/p>\n\n\n\n\n\n\n
    <\/td>\nControl Plane<\/strong><\/td>\nData Plane<\/strong><\/td>\n<\/tr>\n
    What it governs<\/strong><\/td>\nManaging the account: create\/delete databases and containers, change throughput, read keys, configure networking<\/td>\nReading and writing the actual data: documents, queries, stored procedures<\/td>\n<\/tr>\n
    Where roles live<\/strong><\/td>\nAzure RBAC (the same Microsoft.Authorization<\/code>roles you use everywhere in Azure)<\/td>\nCosmos DB’s own data plane RBAC (separate role definitions)<\/td>\n<\/tr>\n
    Example role<\/strong><\/td>\n“Cosmos DB Account Reader”<\/p>\n

    “Contributor”<\/td>\n

    		“Cosmos DB Built-in Data Reader,”<\/p>\n

    “Cosmos DB Built-in Data Contributor”<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    The three pieces<\/strong><\/h2>\n

    1. Who: your app’s identity (use a managed identity)<\/strong><\/h3>\n

    Your app needs an identity that Azure recognizes. You have two real options:<\/p>\n