cosmosdb-operations

Azure Cosmos DB Operations, Scaling & Security

Best practices for operating Azure Cosmos DB: throughput and scaling, global distribution and consistency, monitoring and diagnostics, and security hardening.

When to Apply

Reference these guidelines when provisioning throughput, configuring global distribution, setting up monitoring, or hardening security for Azure Cosmos DB.

Rules

Throughput & Scaling

• throughput-autoscale - Use Autoscale for Variable Workloads
• throughput-burst - Understand Burst Capacity
• throughput-container-vs-database - Choose Container vs Database Throughput
• throughput-right-size - Right-Size Provisioned Throughput
• throughput-serverless - Consider Serverless for Dev/Test

Global Distribution

• global-conflict-resolution - Implement Conflict Resolution
• global-consistency - Choose Appropriate Consistency Level
• global-failover - Configure Automatic Failover
• global-multi-region - Configure Multi-Region Writes
• global-read-regions - Add Read Regions Near Users
• global-zone-redundancy - Configure Zone Redundancy for High Availability

Monitoring & Diagnostics

• monitoring-azure-monitor - Integrate Azure Monitor
• monitoring-diagnostic-logs - Enable Diagnostic Logging
• monitoring-latency - Monitor P99 Latency
• monitoring-ru-consumption - Track RU Consumption
• monitoring-throttling - Alert on Throttling (429s)

Security

• security-continuous-backup - Enable Continuous Backup for Point-in-Time Restore
• security-disable-local-auth - Disable Local Authentication (Keys)
• security-managed-identity - Use Managed Identity with DefaultAzureCredential
• security-network-restrict - Restrict Network Access
• security-rbac-least-privilege - Assign Minimum RBAC Roles with Narrow Scope