title: End-to-end encryption with Azure CosmosDB vs Storage
body: <p>We develop a cloud based SaaS solution suitable for multiple tenants. For very sensitive data, we need to isolate tenants and provide end-to-end encryption for users assigned to this tenant. Not even the operators of the SaaS solution provider should be able to decrypt the data. </p>
  
  <p><strong>Azure Storage</strong></p>
  
  <p>I see that i could use the <a href="https://docs.microsoft.com/en-us/azure/storage/common/storage-client-side-encryption?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json" rel="nofollow noreferrer">client-side encryption feature along with Azure Key Value for Azure Storage</a> to accomplish this, allowing every tenant to provide a separate Azure KeyVault account which manages the encryption keys.</p>
  
  <p><strong>Azure Cosmos DB</strong></p>
  
  <p>As Azure Cosmos DB provides superior features regarding scalability, we would like to use Cosmos over Azure Storage. However, i didn't find a comparable feature for Cosmos DB providing end-to-end encryption capabilitys. The only Cosmos DB encryption feature i found is <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/database-encryption-at-rest" rel="nofollow noreferrer">encryption at rest</a>.</p>
  
  <p>So my question is:</p>
  
  <p>Is there a comparable feature for Azure Cosmos DB i could use to achieve the same goal (end-to-end encryption)?</p>