With Azure Cosmos DB role-based access control now available for Core (SQL) API, you can enable fine-grained access control by assembling allowed actions into role definitions and assigning these roles to Azure Active Directory (AAD) identities. This is the ideal access control method when different data access permissions must be strictly enforced across users or applications. Enhanced auditability is also included as the identity used to issue a data operation gets tracked together with the operation in diagnostic logs.
Learn more about Azure Cosmos DB role-based access control.