Safe Key Rotation for Azure Cosmos DB is now generally available
Azure Cosmos DB's Safe Key Rotation now shows the last-used timestamp for each account key and can be turned on from the Features blade in the Azure portal. Teams can confirm whether a key is still in use before regenerating it or disabling local authentication. That lowers the risk of an outage caused by rotating a key that a forgotten application still depends on.
Key points
- Safe Key Rotation shows the last-used timestamp for each account key.
- Enable it from the Features blade in the Azure portal.
- Check last-used data before regenerating a key or disabling local authentication.
- If a key still shows recent use, plan the move to Entra ID around it.
- Confirm current availability status in the Safe Key Rotation documentation.
Microsoft has announced that Safe Key Rotation for Azure Cosmos DB is now available. The feature was previewed earlier and targets a common problem: an account key that looks idle may still be used by a production application, so rotating it can cause an unexpected outage.
The feature records the last usage timestamp for each account key, so you can see when a key was last used before acting on it. It can be enabled from the Features blade in the Azure portal. Once active, you can regenerate keys or disable local authentication with more confidence, because the timestamps show whether a key is still in use. The post refers to the Safe Key Rotation documentation for setup details. It mixes preview and availability wording, so confirm the current status in the docs.
Real-world use
- Checking whether a legacy production service still uses a key before rotating it.
- Rotating keys safely in an environment where several applications share one Cosmos DB account.
- Planning a move from key-based local authentication to Entra ID.
Why it matters
Key rotation can now be based on usage data instead of guesswork, which reduces the chance of an outage and makes an Entra ID migration easier to plan.
Related stories
- A secure enterprise chat with React, .NET 10 and Microsoft FoundryDEV Community: #dotnet1 d ago
- Securing APIs with Microsoft Entra ID: scope, client and token validationDEV Community: #dotnet3 d ago
- Azure SDK October 2026: Azure Core, managed identity and Cosmos DB for Rust 1.0.0Azure SDK Blog5 d ago