Let us look at how to use the portal to create the service principal in the Azure portal. Access to resources is restricted by the roles assigned to the service principal, giving you control over which resources can be accessed and at which level.

This identity is known as a service principal. When you have an application that connects to your Azure Cosmos DB instance, you can create an identity for the app. In this case, Azure Key Vault provides all the required services to wrap (Encrypt) and unwrap (Decrypt) the data encryption key in use. Encrypting data using always encrypted requires an initial setup as always encrypted relies on Azure Key Vault (when the KeyStoreProvider selected is Azure Key Vault – I will get to that in a bit) to store wrapped data encryption keys which are encrypted using a customer-provided key encryption key created (and stored) in Azure Key Vault. Always encrypted allows clients to protect JSON property values which are deemed sensitive, by means of client encryption policies which can be configured on the containers just like any other policy such as indexing policy etc. Always encrypted for Azure Cosmos DB provides encryption support on the client-side to protect sensitive data by encrypting data such as credit card numbers or national identification numbers, before it gets transferred over the wire to be stored in Azure Cosmos DB.

User azure cosmos db emulator mac