RBAC for Data Plane
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Summary: Fine-grained Microsoft Entra ID permissions for data operations, avoiding shared account keys.
Overview
Azure Cosmos DB supports Azure role-based access control (RBAC) for data plane operations, allowing you to grant fine-grained permissions (read, write, specific operations) to Microsoft Entra ID identities for accessing data within containers, as an alternative or complement to using primary/secondary account keys, improving security by avoiding shared-secret key distribution.
More Info & Links
DP-420 Style Practice Questions
Q1. What does data plane RBAC allow you to control in Azure Cosmos DB?
- A. Fine-grained permissions for Microsoft Entra ID identities to access and operate on data
- B. Which Azure regions data is replicated to
- C. The container's indexing policy
- D. The account's consistency level
Q2. What is an advantage of using Microsoft Entra ID-based data plane RBAC over primary/secondary account keys?
- A. It avoids distributing shared-secret keys and enables fine-grained, identity-based permissions
- B. It automatically enables multi-region writes
- C. It removes the need for TLS encryption
- D. It disables the need for a partition key
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (RBAC for Data Plane): A. Fine-grained permissions for Microsoft Entra ID identities to access and operate on data — Data plane RBAC controls what data operations specific Microsoft Entra ID identities are permitted to perform.
- Q2 (RBAC for Data Plane): A. It avoids distributing shared-secret keys and enables fine-grained, identity-based permissions — RBAC with Microsoft Entra ID avoids shared-secret key distribution and allows more granular, auditable access control.
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
