Kladde.Verlauf stores appointments with the names of contact persons and notes. So far the account cosmos-kladde was only as secure as an account without network rules and with keys can be. This lesson writes the house rules: who may sign in, what they may do, where they may come from and what they do not see in plain text.
Prior knowledge. Managed identity, role assignments in Bicep and least privilege are in "K3, Lesson 3.3.1" and "K3, Lesson 3.3.5"; the client's sign-in is in Lesson 1.2, the disableLocalAuth switch in Lesson 1.1. None of that is repeated.
What was run. Three Bicep files were compiled with az bicep build (Bicep 0.43.8), and a C# program ran without an account (.NET 10). Not run against Azure is everything that needs an account: provisioning, role assignment, sign-in, network rules, masking. Commands for a real account are steps for the person who owns it.
Four layers
| Layer | Setting | Effect |
|---|---|---|
| Sign-in | disableLocalAuth: true |
Entra only, no account keys |
| Rights | roles on the data plane | what a signed-in identity may do |
| Network | publicNetworkAccess, firewall, private endpoint |
where requests may come from |
| Data | dynamic data masking | what readers without a special right see |
Encryption at rest is always on (last section).