Azure Compliance ControlsAzure Cosmos DB
Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)
Evaluates each Azure Cosmos DB account to determine whether its Access Control is configured to use Azure Active Directory (AAD) identities together with Role-Based Access Control (RBAC) for authorizing requests to the account.
What this control checks
Cosmos DB accounts must use Azure AD and RBAC for access control
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 4.5.3 Use Azure Active Directory (AAD) Client Authentication and Azure RBAC where possible.
- 4.5.3 Use Entra ID Client Authentication and Azure RBAC where possible.
- 5.4.3 Use Entra ID Client Authentication and Azure RBAC where possible
- 164.308(a)(4)(ii)(B) Access authorization
- 164.312(a)(2)(i) Unique user identification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_uses_aad_and_rbac - Powerpipe Control:
azure_compliance.control.cosmosdb_account_uses_aad_and_rbac - Prowler Check:
cosmosdb_account_use_aad_and_rbac - Azure Policy Definitions:
5450f5bd-9c72-4390-a9c4-a7aba4edfdd2,dc2d41d1-4ab1-4666-a3e1-3d51c43e0049
Last reviewed: 2026-10-11