Disable local auth for Cosmos db

[msftrubengu]

Disable local authentication for Cosmos DB and use managed identities for authentication in Azure functions.

There is no built-in role for read/write operations in Cosmos DB. A custom role needs to be created (defined in passwordlessRole.json). To create and assign the role these commands must be executed:

az cosmosdb sql role definition create --account-name <cosmos db account> --resource-group <resource group> --body @passwordlessRole.json
az cosmosdb sql role assignment create --account-name <cosmos db account> --resource-group <resource group> --scope "/" --principal-id <principal id> --role-definition-id <role definition id>

Where <role definition id> can be obtained from name property of the output of the az cosmosdb sql role definition create command and <principal id> is the principal id of the azure function. Easiest way to get it is via Get-AzADServicePrincipal -DisplayName <az func name>

[msftrubengu]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).