In addition to implementing network security controls, we encourage the use of Role Based Access Control.

These network protection mechanisms prevent access from outside your network and unexpected locations.

All Azure Cosmos DB customers use a combination of firewall rules, vNet, and/or Azure Private Link on their account.

It is also recommended as a best practice:

Though no customer data was accessed, it is recommended you regenerate your primary read-write keys following the steps described in this technical documentation. How to regenerate your primary read-write key: Our suggestion is to enable Diagnostic Logging and Azure Defender where available and periodically rotate your keys.

If you have diagnostic logs enabled, you can also review the logs for unusual IP addresses. If you did not receive an email or in-portal notification, there is no evidence any other external parties had access to your primary read-write account key. Other keys including the secondary read-write key, primary read-only key, and secondary read-only key were not vulnerable.

Notifications have been sent to all customers that could be potentially affected due to researcher activity, advising they regenerate their primary read-write key. This vulnerability only affects a subset of customers who had the Jupyter Notebook feature enabled. Which Azure Cosmos DB accounts were potentially affected? Thank you to researchers Sagi Tzadik and Nir Ohfeld from Wiz who reported this vulnerability and worked with the Microsoft Security Response Center (MSRC) under Coordinated Vulnerability Disclosure (CVD). Part of any robust security posture is working with researchers to help find vulnerabilities, so we can fix them before they can be used. Our investigation indicates that no customer data was accessed because of this vulnerability by third parties or security researchers. We’ve notified the customers whose keys may have been affected during the researcher activity to regenerate their keys. We mitigated the vulnerability immediately. On August 12, 2021, a security researcher reported a vulnerability in the Azure Cosmos DB Jupyter Notebook feature that could potentially allow a user to gain access to another customer’s resources by using the account’s primary read-write key.

Microsoft customer evidence