Question
You have an Azure Cosmos DB for NoSQL account named account1 that has the disableKeyBasedMetadataWriteAccess property enabled.
You are developing an app named App1 that will be used by a user named DevUser1 to create containers in account1. DevUser1 has a non-privileged user account in the Microsoft Entra ID tenant.
You need to ensure that DevUser1 can use App1 to create containers in account1.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Grant permissions to create containers by using: Role-based access control (RBAC). With disableKeyBasedMetadataWriteAccess enabled, metadata changes such as creating containers can only be made by a user who holds the proper Azure role (for example Cosmos DB Operator or a custom control-plane role) assigned through Azure RBAC. Account keys are exactly what the property blocks for metadata writes, and resource tokens only grant data-plane access to existing resources, so neither lets DevUser1 create containers.
Create containers by using the: Azure Resource Manager API. When the property is set, create and update operations issued through the Cosmos DB endpoint (the NoSQL SDK) fail with an 'Operation POST ... is not allowed through Azure Cosmos DB endpoint' error, so App1 must send them through Azure Resource Manager (directly or via Azure CLI, PowerShell or templates). The Azure AD Graph API manages directory objects, not Cosmos DB resources.
