Which authentication approach removes account keys from an application entirely?
- A Read-only keys
- B Managed identity with Cosmos DB data-plane RBAC role assignments (correct answer)
- C Resource tokens
- D Connection string in Key Vault
Shortcut: Cosmos DB supports Azure AD data-plane RBAC. Assigning a managed identity the Cosmos DB Built-in Data Contributor role lets the SDK authenticate with a token, so no key exists to leak.