You are building a Java app that stores sensitive data in Azure Cosmos DB and want to configure Always Encrypted so the application encrypts data. What is the first step you should take?

The first step in configuring Always Encrypted for Azure Cosmos DB is to establish the root of trust for your encryption keys. This involves creating a customer-managed key (CMK) and securely storing it in an Azure Key Vault instance. This CMK acts as the master key that protects your data encryption keys (DEKs). Without a CMK, you cannot proceed to create DEKs or configure encryption policies. Creating a new container with an encryption policy is a subsequent step, as it relies on the existence of DEKs, which are themselves protected by the CMK. Creating a DEK using the SDK is also a later step, as DEKs are derived from and protected by the CMK. Creating an Azure AD managed identity and assigning it to Key Vault is important for secure access, but the CMK itself must first exist in Key Vault.