Cosmos DB security: which control protects what
This sheet compares IP firewall rules, VNet service tags, Always Encrypted, Customer-managed keys.
| Criterion | IP firewall rules | VNet service tags | Always Encrypted | Customer-managed keys |
|---|---|---|---|---|
| Protects | Which source IPs can reach the account | Isolates the account to a VNet via NSG rules | Specific fields from privileged data-plane users | Encryption-at-rest key ownership |
The verdict, the full comparison, 3 rules and 3 traps are part of DP-420 access. Unlock DP-420.