Security
Security
My team is growing: how should I structure Cosmos DB access?
Azure Cosmos DB for NoSQL keeps control-plane management in Azure RBAC and item access in its own data-plane RBAC. Microsoft's guidance is to model access around jobs, not people: Entra groups, one managed identity per workload, the narrowest role and scope, and temporary elevation for production.