You need to securely access inventory items when developing the Inventory Items API.

Create a custom Microsoft Entra role

Assign the custom role to the Azure Cosmos DB account Update the function app to use certificate-based authentication.

Create a SQL role definition under the Azure Cosmos DB account.

Create a user-assigned managed identity and assign the identity to the function app.

Assign the user-assigned managed identity the SQL role definition.

Update the function app code to implement the DefaultAzurecredential class and reference the user-assigned managed identity.

Create a system-assigned managed identity for the function app with read access to secrets in Azure Key Vault. Store the Azure Cosmos DB primary key and URI in Azure Key Vault as secrets.

Use function app settings to reference the secret values.

Create a custom Microsoft Entra role. Assign the custom role to Azure Key Vault. Assign the custom role to the function app.

Reference the custom role in the function app code when accessing Azure Key Vault values.

Create a SQL role definition under the Azure Cosmos DB account. Assign the role to the function app's system-assigned managed identity. Programmatically access the Azure Cosmos OB keys from the function app.