-You must use an existing user-assigned managed identity to authorize access to the key vault when you configure customer-managed keys while creating the Azure Cosmos DB account. The user-assigned managed identity must have appropriate permissions to access the key vault. As the key vault is on another tenant, we'll use the multi tenant application created previously and register the user assigned managed identity as a federated identity of this multi-tenant application. For more information, see the [Phase 3 - The service provider encrypts data in an Azure resource using the customer-managed key](#phase-3---The-service-provider-encrypts-data-in-an-azure-resource-using-the-customer-managed-key) section of this article.
0 commit comments