Use the Knowledge Base AI to help improve your Cloud Posture

Enable Geo-Redundancy for Azure Cosmos DB Clusters

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that geo-redundancy is enabled and configured for your Microsoft Azure Cosmos DB clusters in order to provide resilience against regional outages and improve availability by replicating your data across multiple Azure cloud regions.

Reliability

Enabling geo-redundancy for your Microsoft Azure Cosmos DB clusters automatically replicates your data to the region geo-paired with your current region. Geo-redundancy provides 99.999% availability even when disaster strikes. This feature allows you to take advantage of the provisioned throughput for your Cosmos DB databases across the globe.


Audit

To determine if geo-redundancy is enabled for your Microsoft Azure Cosmos DB clusters, perform the following operations:

Using Azure Portal

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Cosmos DB account for Value, then choose Apply to list the Azure Cosmos DB accounts available in the selected subscription.

05 Click on the name (link) of the Azure Cosmos DB account that you want to examine.

06 In the resource navigation panel, under Settings, select Replicate data globally to access the replication and failover configuration settings available for the selected resource.

07 In the Configurations section, verify the Multi-region writes setting status to determine if geo-redundancy is enabled for your database cluster. If the Multi-region writes setting checkbox is unchecked, geo-redundancy is not enabled for the selected Microsoft Azure Cosmos DB cluster.

08 Repeat steps no. 5 – 7 for each Azure Cosmos DB account available in the selected subscription.

09 Repeat steps no. 3 – 8 for each Azure subscription created within your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run cosmosdb list command (Windows/macOS/Linux) with custom output filters to list the ID of each Azure Cosmos DB account available in the selected subscription:

az cosmosdb list
	--query '[*].id'

05 The command output should return the requested Azure Cosmos DB account IDs:

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.DocumentDB/databaseAccounts/cc-project5-cosmos-database",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.DocumentDB/databaseAccounts/cc-cosmos-prod-dba-account"
]

06 Run cosmosdb show command (Windows/macOS/Linux) with the name of the Azure Cosmos DB account that you want to examine as the identifier parameter and custom output filters to determine if geo-redundancy is enabled for the selected Cosmos DB account:

az cosmosdb show
	--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.DocumentDB/databaseAccounts/cc-project5-cosmos-database"
	--query 'enableMultipleWriteLocations'

07 The command output should return the status of the "enableMultipleWriteLocations" setting configured for the selected resource (true for enabled, false for disabled):

false

If the command output returns "Disabled" for "publicNetworkAccess", as shown in the example above, network access via public endpoints or selected networks is disabled, therefore, you can continue the Audit process with the next step. Otherwise, the Audit process stops here.

08 Repeat steps no. 6 and 7 for each Azure Cosmos DB account available within the selected Azure subscription.

09 Repeat steps no. 3 – 8 for each Azure subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

To enable and configure geo-redundancy for your Microsoft Azure Cosmos DB clusters, perform the following operations:

Using Azure Portal

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Cosmos DB account for Value, then choose Apply to list the Azure Cosmos DB accounts available in the selected subscription.

05 Click on the name (link) of the Azure Cosmos DB account that you want to configure.

06 In the resource navigation panel, under Settings, select Replicate data globally to access the replication and failover configuration settings available for the selected resource.

07 In the Configurations section, perform the following actions to enable and configure geo-redundancy for your Azure Cosmos DB cluster:

  1. Check the Multi-region writes setting checkbox to enable the Geo-Redundancy feature.
  2. Add one or more Azure cloud regions by selecting the plus icons on the coverage map or by choosing + Add region and selecting the supported regions. All the cloud regions you add have both read and writes enabled.
  3. Choose Save to apply the configuration changes.

08 Repeat steps no. 5 – 7 for each Azure Cosmos DB account that you want to configure, available in the selected subscription.

09 Repeat steps no. 3 – 8 for each Azure subscription created within your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run cosmosdb update command (OSX/Linux/UNIX) with the ID of the Azure Cosmos DB account that you want to configure as the identifier parameter, to enable and configure the Geo-Redundancy feature (i.e., multi-region writes) for the selected Azure Cosmos DB account. Use the --locations command parameter to add one or more Azure cloud regions to the geo-redundant configuration:

az cosmosdb update
	--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.DocumentDB/databaseAccounts/cc-project5-cosmos-database"
	--enable-multiple-write-locations true
	--locations regionName=westeurope failoverPriority=0 isZoneRedundant=False
	--locations regionName=uksouth failoverPriority=1 isZoneRedundant=True

05 The command output should return the configuration information available for the modified Cosmos DB resource:

{
	"analyticalStorageConfiguration": {
		"schemaType": "WellDefined"
	},
	"apiProperties": null,
	"backupPolicy": {
		"migrationState": null,
		"periodicModeProperties": {
			"backupIntervalInMinutes": 240,
			"backupRetentionIntervalInHours": 8,
			"backupStorageRedundancy": "Geo"
		},
		"type": "Periodic"
	},
	"capabilities": [],
	"capacity": null,
	"connectorOffer": null,
	"consistencyPolicy": {
		"defaultConsistencyLevel": "Session",
		"maxIntervalInSeconds": 5,
		"maxStalenessPrefix": 100
	},
	"databaseAccountOfferType": "Standard",
	"defaultIdentity": "FirstPartyIdentity",
	"disableKeyBasedMetadataWriteAccess": false,
	"disableLocalAuth": false,
	"enableAnalyticalStorage": false,
	"enableAutomaticFailover": true,
	"enableBurstCapacity": false,
	"enableCassandraConnector": null,
	"enableFreeTier": false,
	"enableMultipleWriteLocations": true,
	"enablePartitionMerge": false,
	"enablePerRegionPerPartitionAutoscale": true,
	"failoverPolicies": [
		{
			"failoverPriority": 0,
			"id": "cc-project5-cosmos-database-westeurope",
			"locationName": "West Europe"
		},
		{
			"failoverPriority": 1,
			"id": "cc-project5-cosmos-database-uksouth",
			"locationName": "UK South"
		}
	],
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.DocumentDB/databaseAccounts/cc-project5-cosmos-database",
	"identity": {
		"principalId": null,
		"tenantId": null,
		"type": "None",
		"userAssignedIdentities": null
	},
	"isVirtualNetworkFilterEnabled": false,
	"keyVaultKeyUri": null,
	"keysMetadata": {
		"primaryMasterKey": {
			"generationTime": "2025-05-23T10:15:26.993514+00:00"
		},
		"primaryReadonlyMasterKey": {
			"generationTime": "2025-05-23T10:15:26.993514+00:00"
		},
		"secondaryMasterKey": {
			"generationTime": "2025-05-23T10:15:26.993514+00:00"
		},
		"secondaryReadonlyMasterKey": {
			"generationTime": "2025-05-23T10:15:26.993514+00:00"
		}
	},
	"kind": "GlobalDocumentDB",
	"location": "West Europe",
	"locations": [
		{
			"failoverPriority": 0,
			"id": "cc-project5-cosmos-database-westeurope",
			"isZoneRedundant": false,
			"locationName": "West Europe",
			"provisioningState": "Succeeded"
		},
		{
			"failoverPriority": 1,
			"id": "cc-project5-cosmos-database-uksouth",
			"isZoneRedundant": true,
			"locationName": "UK South",
			"provisioningState": "Succeeded"
		}
	],
	"minimalTlsVersion": "Tls12",
	"name": "cc-project5-cosmos-database",
	"networkAclBypass": "None",
	"networkAclBypassResourceIds": [],
	"privateEndpointConnections": null,
	"provisioningState": "Succeeded",
	"publicNetworkAccess": "Enabled",
	"readLocations": [
		{
			"failoverPriority": 0,
			"id": "cc-project5-cosmos-database-westeurope",
			"isZoneRedundant": false,
			"locationName": "West Europe",
			"provisioningState": "Succeeded"
		},
		{
			"failoverPriority": 1,
			"id": "cc-project5-cosmos-database-uksouth",
			"isZoneRedundant": true,
			"locationName": "UK South",
			"provisioningState": "Succeeded"
		}
	],
	"resourceGroup": "cloud-shell-storage-westeurope",
	"restoreParameters": null,
	"tags": {
		"defaultExperience": "Core (SQL)",
		"hidden-cosmos-mmspecial": "",
		"hidden-workload-type": "Production"
	},
	"type": "Microsoft.DocumentDB/databaseAccounts",
	"virtualNetworkRules": [],
	"writeLocations": [
		{
			"failoverPriority": 0,
			"id": "cc-project5-cosmos-database-westeurope",
			"isZoneRedundant": false,
			"locationName": "West Europe",
			"provisioningState": "Succeeded"
		},
		{
			"failoverPriority": 1,
			"id": "cc-project5-cosmos-database-uksouth",
			"isZoneRedundant": true,
			"locationName": "UK South",
			"provisioningState": "Succeeded"
		}
	]
}

06 Repeat steps no. 4 and 5 for each Azure Cosmos DB account that you want to configure, available within the selected subscription.

07 Repeat steps no. 3 – 6 for each Azure subscription created within your Microsoft Azure cloud account.

References

Publication date May 28, 2025