Back to Checks
azure

Cosmos DB account has local authentication disabled and uses Azure AD authentication with Azure RBAC

cosmosdb_account_use_aad_and_rbac
Service: cosmosdbSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:microsoft.documentdb/databaseaccounts

Azure Cosmos DB accounts configured to use Microsoft Entra ID with Azure RBAC by disabling key-based credentials (disableLocalAuth=true). Clients authenticate with identities rather than account keys.

Prowler logoProwlerprowler-provider-azure

Risk

With local/key-based auth enabled, long-lived account keys can be leaked or shared, enabling unauthorized reads/writes and tampering. Access bypasses MFA and granular RBAC, hindering rotation/revocation and increasing persistence and lateral movement risks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks cosmosdb_account_use_aad_and_rbac

Recommendation

Disable local authentication by setting disableLocalAuth=true and require Entra ID + Azure RBAC for control and data access. Use managed identities, apply least privilege roles, retire shared keys, and enforce zero trust with conditional access and short-lived credentials.

Remediation

CLI

az resource update --resource-group <RESOURCE_GROUP> --name <COSMOS_ACCOUNT_NAME> --resource-type Microsoft.DocumentDB/databaseAccounts --set properties.disableLocalAuth=true

Terraform

# Terraform: Disable local (key-based) auth on a Cosmos DB account
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  geo_location {
    location          = "<example_resource_name>"
    failover_priority = 0
  }

  local_authentication_disabled = true # Critical: Disables key-based auth to enforce Entra ID + RBAC
}

NativeIaC

// Bicep: Disable local (key-based) auth on a Cosmos DB account
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: resourceGroup().location }]
    disableLocalAuth: true // Critical: Disables key-based auth to enforce Entra ID + Azure RBAC
  }
}

Other

1Sign in to the Azure portal and open your Cosmos DB account
2In the left menu, select Keys
3Turn on Disable key-based authentication (Disable local authentication)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client


class cosmosdb_account_use_aad_and_rbac(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, accounts in cosmosdb_client.accounts.items():
            subscription_name = cosmosdb_client.subscriptions.get(
                subscription, subscription
            )
            for account in accounts:
                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription_name} ({subscription}) is not using AAD and RBAC"
                if account.disable_local_auth:
                    report.status = "PASS"
                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription_name} ({subscription}) is using AAD and RBAC"
                findings.append(report)

        return findings

References