# Cosmosdb Security

> Azure Cosmos DB security best practices: disabling local authentication (keys), managed identity with DefaultAzureCredential, network access restrictions, RBAC least privilege, and continuous backup for point-in-time restore. USE FOR: Cosmos DB security, disable local auth, disable keys, managed identity, DefaultAzureCredential, Entra ID, network restrictions, IP firewall, private endpoints, RBAC roles, least privilege, data plane roles, continuous backup, point-in-time restore, PITR, zero-trust. DO NOT USE FOR: client-side encryption (pending), SDK authentication code (use cosmosdb-sdk).

- Skill: `atc-net/cosmosdb-security` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add atc-net/cosmosdb-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/atc-net/cosmosdb-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: atc-net (https://skillmd.com/u/atc-net)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/atc-net/cosmosdb-security

---


# Azure Cosmos DB Security

Security best practices for Azure Cosmos DB accounts, covering authentication, network isolation, access control, and data protection.

## When to Apply

Reference these guidelines when:
- Setting up authentication for Cosmos DB
- Configuring network access restrictions
- Assigning RBAC roles for data plane access
- Enabling continuous backup
- Hardening a Cosmos DB account for production

## Rules

- [security-disable-local-auth](references/security-disable-local-auth.md) - Disable local authentication (keys)
- [security-managed-identity](references/security-managed-identity.md) - Use managed identity with DefaultAzureCredential
- [security-network-restrict](references/security-network-restrict.md) - Restrict network access
- [security-rbac-least-privilege](references/security-rbac-least-privilege.md) - Assign minimum RBAC roles
- [security-continuous-backup](references/security-continuous-backup.md) - Enable continuous backup for PITR