You use Azure AD–based role assignments for data-plane access to Azure Cosmos DB SQL API. A microservice must read and query items and execute stored procedures in a single container, but it must not create, update, or delete items. How should you grant access?

The correct answer is to create a custom data role definition. The microservice needs specific permissions: read, query, and execute stored procedures, but not create, update, or delete. The built-in "Cosmos DB Built-in Data Reader" role only allows read and query, lacking stored procedure execution. The "Cosmos DB Built-in Data Contributor" role grants full data access, including create, update, and delete, which is too permissive. Custom roles allow you to define precise dataActions (like Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read and Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/storedProcedures/execute) to meet the exact requirements without over-privileging the service principal. Resource tokens are an alternative authorization method, but the question specifically asks about Azure AD-based role assignments.