BE
To audit all users who access the data in Azure Cosmos DB Core (SQL) API accounts, the best recommendations are:

✅ . Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace
Why? Azure AD sign-in logs provide visibility into authentication and access attempts to Azure Cosmos DB accounts, helping to audit user access and identify unauthorized access patterns.
✅ Send the Azure Cosmos DB logs to a Log Analytics workspace
Why? Azure Cosmos DB diagnostic logs capture detailed information about operations performed on the database, including data access, queries, and actions by different users. Sending these logs to a Log Analytics workspace allows centralized analysis, auditing, and alerting.
Explanation of Other Options:
Enable Microsoft Defender for Identity: ❌

This focuses on detecting identity threats in hybrid environments, primarily Active Directory, and doesn't specifically address auditing Azure Cosmos DB data access.
Disable local authentication for Azure Cosmos DB: ❌

While this improves security by enforcing Azure AD authentication, it doesn’t directly contribute to auditing access.
Enable Microsoft Defender for Cosmos DB: ❌

While it helps detect threats and misconfigurations, it is not primarily an auditing solution....