Cosmos DB Account Reader Role
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Summary: Can read Azure Cosmos DB account data; cannot provision resources or make changes.
Overview
Cosmos DB Account Reader Role is a built-in Azure RBAC (control-plane) role that can read Azure Cosmos DB account data — including viewing account configuration and reading item data — without permission to make any changes to the account or its resources. It is commonly assigned to auditors, monitoring tools, or team members who need read visibility into an account without provisioning rights (contrast with Cosmos DB Operator, which can provision resources but not read data).
More Info & Links
DP-420 Style Practice Questions
Q1. What does the Cosmos DB Account Reader Role permit?
- A. Reading Azure Cosmos DB account data and configuration, without making changes
- B. Provisioning new databases and containers
- C. Restoring a deleted account from continuous backup
- D. Submitting a periodic backup restore request
Q2. How does Cosmos DB Account Reader Role differ from Cosmos DB Operator?
- A. Account Reader can read account data but cannot provision resources, while Cosmos DB Operator can provision resources but cannot access data
- B. They are identical roles with different names
- C. Account Reader can restore accounts, while Cosmos DB Operator cannot
- D. Cosmos DB Operator can read data but not provision resources
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (Cosmos DB Account Reader Role): A. Reading Azure Cosmos DB account data and configuration, without making changes — This role provides read access to account data/configuration but no ability to modify resources or provision new ones.
- Q2 (Cosmos DB Account Reader Role): A. Account Reader can read account data but cannot provision resources, while Cosmos DB Operator can provision resources but cannot access data — Account Reader is read-focused on data/configuration, whereas Cosmos DB Operator is focused on provisioning without data access.
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
