cis-azure-database-3-3

name	cis-azure-database-3.3
description	Ensure that 'disableLocalAuth' is set to 'true'
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","cosmos-db","nosql"]
cis_id	3.3
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

3.3 Ensure that 'disableLocalAuth' is set to 'true' (Automated)

Profile Applicability

• Level 1

Description

Ensure that key-based authentication (including resource owner password credential authentication) is disabled for Azure Cosmos DB accounts by setting disableLocalAuth to true. Instead, use Microsoft Entra ID for authentication, as it provides stronger security through managed credentials, multi-factor authentication (MFA), centralized access control, and seamless integration with Azure RBAC.

Rationale

Disabling key-based authorization ensures that access to your Azure Cosmos DB account relies on the more secure Microsoft Entra ID authentication, reducing the risk of credential misuse and unauthorized access.

Impact

Administrative overhead in configuring, managing, and monitoring Entra ID authentication and role-based access.

Audit Procedure

Audit from Azure CLI

Run the following command to get the disableLocalAuth setting for each Cosmos DB account:

az cosmosdb list --query "[].{name:name, resourceGroup:resourceGroup, disableLocalAuth:disableLocalAuth}"

Ensure that disableLocalAuth is set to true for each Cosmos DB account.

Audit from PowerShell

Run the following command to list Cosmos DB accounts in a resource group:

Get-AzCosmosDBAccount -ResourceGroupName <resource-group>

Run the following command to get the Cosmos DB account in a resource group with a given name:

$cosmosdb = Get-AzResource -ResourceType Microsoft.DocumentDB/databaseAccounts -ResourceGroupName <resource-group> -ResourceName <cosmosdb-account>

Run the following command to get the disableLocalAuth setting for the Cosmos DB account:

$cosmosdb.Properties.disableLocalAuth

Ensure that the command returns True.

Repeat for each Cosmos DB account.

Audit from Azure Policy

• Policy ID: 5450f5bd-9c72-4390-a9c4-a7aba4edfdd2 - Name: 'Cosmos DB database accounts should have local authentication methods disabled'

Expected Result

disableLocalAuth should be set to true for each Cosmos DB account.