services / Azure / Cosmos DB database account

An Azure Cosmos DB (DocumentDB) database account, the top-level control-plane resource that hosts databases and containers and governs endpoints, regions, consistency, networking, identity, and backup configuration. It is a primary production data store.

Account master keys are root-equivalent data-plane credentials granting full read/write access to all data in the account, which makes this resource type security-sensitive.

Microsoft.​DocumentDB/​databaseAccounts/​getBackupPolicy/​action

Reads the account's backup policy configuration (type, interval, retention). Reveals backup posture useful for reconnaissance but discloses no data or credentials on its own.

Risks

1. Metadata discovery (LOW)

Scope: LOW

This privilege allows access to data that are not meant to be public, but are otherwise not sensitive.

Links