Lesson 28 — Microsoft Defender for Azure Cosmos DB
Azure Cosmos DB is designed for globally distributed applications that need low-latency access to operational data. That speed and reach also make identity, credential and query abuse especially important to detect.
Microsoft Defender for Azure Cosmos DB is an Azure-native threat-protection plan that detects potential SQL injection, access from known malicious actors, suspicious access patterns and activity involving compromised identities or malicious insiders.
This lesson explains plan scope, supported workloads, authentication methods, network controls, diagnostic logging, alert investigation, credential response and the operational checks required to prove that suspicious database access has been contained.
What you will learn
This lesson follows Cosmos DB protection from identity and networking through alert investigation and credential recovery.
How Microsoft Defender for Azure Cosmos DB works
↓
Cosmos DB processes the query or data operation
↓
Defender analyses activity patterns and threat intelligence
↓
Suspicious access, known malicious infrastructure or injection behaviour is identified
↓
A Defender for Cloud security alert is generated
↓
Agent Foskett reviews the account, identity, key, query, source and affected data
↓
The access method and compromise path are confirmed
↓
Credentials are revoked or rotated
↓
Identity and network permissions are restricted
↓
Application weaknesses are corrected
↓
Monitoring confirms the suspicious activity has stopped
Cosmos DB security layers
| Layer | Purpose | Example |
|---|---|---|
| Identity | Identify the caller. | Managed identity or Microsoft Entra principal. |
| Authorisation | Limit data-plane permissions. | Cosmos DB RBAC. |
| Network | Restrict reachable access paths. | Private endpoint and firewall. |
| Application security | Prevent unsafe queries and excessive access. | Parameterised query and input validation. |
| Threat detection | Identify suspicious runtime activity. | Defender for Azure Cosmos DB alert. |
| Investigation | Reconstruct access and impact. | Diagnostic logs, Activity Log and app telemetry. |
| Recovery | Restore trusted access and data availability. | Credential rotation and backup recovery. |
Learning objectives
- Explain Microsoft Defender for Azure Cosmos DB.
- Understand current plan scope.
- Recognise suspicious database activity.
- Review authentication and credential risk.
- Apply network and identity protections.
- Investigate Defender alerts.
- Contain credential misuse and data exposure.
What is Azure Cosmos DB?
Azure Cosmos DB is a globally distributed NoSQL database service designed for high availability, low latency and elastic scale.
What is Defender for Azure Cosmos DB?
Microsoft Defender for Azure Cosmos DB is an Azure-native threat-protection plan that detects unusual and potentially harmful attempts to access or exploit Cosmos DB accounts.
Current plan scope
The current Defender plan applies to Azure Cosmos DB for NoSQL. Other Cosmos DB APIs should not be assumed to have identical Defender coverage.
Defender for Databases
Defender for Azure Cosmos DB is part of the broader Defender for Databases workload-protection family in Microsoft Defender for Cloud.
Threat analytics
Defender analyses Cosmos DB activity and combines behavioural patterns with Microsoft threat intelligence to identify suspicious access.
Potential SQL injection
For the API for NoSQL, suspicious query patterns can indicate that untrusted application input has reached a database query without safe handling.
Known malicious actors
Connections from known malicious infrastructure, Tor exit nodes or suspicious hosting sources can increase alert confidence.
Suspicious access patterns
Unusual access volume, unfamiliar locations, rapid enumeration or atypical account use can indicate credential theft or insider abuse.
Compromised identities
A legitimate identity may become an attack path after token theft, service principal compromise or excessive role assignment.
Malicious insiders
Defender can help identify activity that is technically authorised but differs from the user or application's normal behaviour.
Primary keys
Cosmos DB account keys provide broad access and should be protected like high-value credentials. Rotate them immediately if exposure is suspected.
Read-only keys
Read-only keys reduce write capability but can still expose sensitive data. They require the same careful handling, rotation and monitoring.
Connection strings
Connection strings often contain account endpoints and keys. Keep them out of source code, build logs, support tickets and client-side applications.
Microsoft Entra authentication
Where supported, use Microsoft Entra identities and role-based access to improve attribution and reduce reliance on shared account keys.
Cosmos DB RBAC
Use data-plane role assignments to limit identities to the databases, containers and operations they genuinely require.
Managed identities
Managed identities allow Azure workloads to access Cosmos DB without storing static secrets. Their permissions must still follow least privilege.
Control plane
Control-plane activity includes account creation, networking changes, key regeneration, role assignments and Defender configuration.
Data plane
Data-plane activity includes reading, creating, updating, deleting and querying documents within databases and containers.
Public network access
Disable or restrict public network access where it is not required. Defender alerts do not replace secure connectivity design.
Firewall rules
Restrict allowed networks and IP ranges to approved applications, administrators and services.
Private endpoints
Private endpoints can provide private network connectivity to Cosmos DB and reduce exposure through public paths.
Service endpoints
Virtual network service endpoints can restrict account access to selected networks, but architecture and DNS behaviour should be validated carefully.
Diagnostic logging
Enable diagnostic settings to support a fuller investigation experience, including database and container operations where available.
Log Analytics
Send relevant logs to Log Analytics when central search, correlation, alerting and Microsoft Sentinel integration are required.
Azure Activity Log
Use the Activity Log to investigate control-plane changes such as key regeneration, networking updates, role assignments and account deletion.
Application logs
Application telemetry helps show which code path, identity and user action generated the database request.
Query safety
Validate application input and use safe query construction. Never concatenate untrusted values directly into query text.
Parameterised queries
Parameterisation separates query structure from user-supplied values and reduces injection risk.
Least-privilege containers
Applications should access only the databases and containers required for their function.
Data minimisation
Return only the fields and documents required by the caller. Excessive results increase exposure during credential misuse.
Rate and volume controls
Monitor unusual request rates, cross-partition queries, bulk exports and sudden increases in retrieved documents.
Partition awareness
High-volume access across many partition keys may indicate enumeration or exfiltration rather than normal application behaviour.
Multi-region access
Global distribution can make legitimate access geographically diverse. Investigators must compare activity with known application regions and failover design.
Backup and recovery
Use the appropriate backup mode and recovery design to reduce the impact of malicious deletion or corruption.
Encryption
Cosmos DB encrypts data at rest. Customer-managed keys can add control but also create key availability and governance responsibilities.
Defender alerts
Alerts include details about suspicious activity, possible causes, affected resources and recommended investigation or mitigation steps.
Alert severity
Severity should be considered with business criticality, data sensitivity, identity privilege, request volume and network exposure.
Initial triage
Confirm the account, database, container, identity, source IP, operation, location and time range associated with the alert.
Identity investigation
Review Entra sign-ins, service principal activity, managed identity use, role assignments and recent credential changes.
Key investigation
Determine whether an account key or connection string was used and where that credential may have been exposed.
Query investigation
Review suspicious query patterns, request volume, parameters, returned data and whether the application should have issued the operation.
Network investigation
Compare the source address with approved networks, private endpoints, application hosts and normal regional access.
Scope investigation
Search for the same identity, key, source, user agent or request pattern across other Cosmos DB accounts and Azure resources.
Containment
- Disable or restrict the compromised identity.
- Regenerate exposed account keys.
- Rotate connection strings and application secrets.
- Remove excessive role assignments.
- Restrict public network access.
- Block malicious sources.
- Preserve logs and application evidence.
Application remediation
Patch injection weaknesses, move to managed identity where practical, reduce permissions and redeploy applications with updated credentials.
Validation
Confirm the old credential no longer works, legitimate applications use the new access method, suspicious activity has stopped and no alternate path remains.
Agent Foskett investigation: “The database wasn’t breached…”
↓
No database outage occurred
↓
Defender for Azure Cosmos DB detected unusual document access
↓
One credential began reading thousands of records
↓
The requests came from an unfamiliar hosting provider
↓
Agent Foskett reviewed the authentication method
↓
The requests used a valid Cosmos DB account key
↓
The key had been copied into a support ticket months earlier
↓
The attacker used the trusted key from outside the approved network
↓
The key was regenerated
↓
Application connection strings were updated
↓
Public network access was restricted
↓
The application moved to managed identity and Cosmos DB RBAC
↓
Logs were reviewed to determine which records were accessed
↓
The database had not been broken
↓
The attacker was using a credential it already trusted
Cosmos DB investigation checklist
| Area | Question | Evidence |
|---|---|---|
| Account | Which Cosmos DB account, database and container were involved? | Defender alert and resource inventory. |
| Identity | Was access key-based, Entra-based or managed identity-based? | Alert details, app configuration and sign-in records. |
| Source | Where did the activity originate? | IP address, hosting provider, geography and network path. |
| Operation | What queries or document operations were performed? | Diagnostic logs and application telemetry. |
| Volume | How many documents or partitions were accessed? | Request counts, returned data and time sequence. |
| Credential | Could the same key or token still be used? | Key status, connection strings and role assignments. |
| Scope | Were other accounts or Azure resources accessed? | Identity, IP and credential correlation. |
| Recovery | Were credentials rotated and access paths retested? | Change records and validation results. |
Key takeaways
- Microsoft Defender for Azure Cosmos DB provides Azure-native threat detection for Cosmos DB for NoSQL.
- It detects potential SQL injection, known malicious actors and suspicious access patterns.
- Compromised identities and valid account keys can create trusted-looking attack paths.
- Microsoft Entra authentication and Cosmos DB RBAC improve attribution and least privilege.
- Account keys and connection strings must be protected and rotated after exposure.
- Private endpoints and firewall rules reduce reachable access paths.
- Diagnostic logging improves investigation of document and container operations.
- Parameterised queries reduce injection risk.
- Investigations must review identity, source, operation, volume and affected data.
- Containment is not complete until old credentials and network paths are proven unusable.
What Agent Foskett checked
- Defender alert
- Cosmos DB account
- Database
- Container
- Authentication type
- Identity
- Account key
- Source IP
- Query pattern
- Document volume
- Network rules
- Other affected resources
Best practices
- Enable Defender protection.
- Use Microsoft Entra authentication.
- Apply least-privilege RBAC.
- Protect and rotate account keys.
- Use private endpoints where suitable.
- Restrict public access.
- Enable diagnostic logging.
- Use parameterised queries.
- Monitor unusual access volume.
- Validate containment.
Related Agent Foskett resources
Continue learning
What is Microsoft Defender for Azure Cosmos DB?
Microsoft Defender for Azure Cosmos DB is a Microsoft Defender for Cloud database-protection plan that detects potential SQL injection, known malicious actors and suspicious access patterns affecting Azure Cosmos DB for NoSQL.
Microsoft Defender for Azure Cosmos DB Lesson
This Agent Foskett lesson explains Cosmos DB threat detection, account-key risk, Microsoft Entra authentication, RBAC, network controls, diagnostic logging, alert investigation, containment and recovery.
