Cosmos DB keys don't expire on their own

A leaked Cosmos DB master key grants full read and write access to every database in that account, with zero identity-based control attached to it: no Conditional Access, no MFA, no audit trail tied to a real person. Disabling local (key-based) authentication is a single setting, but until someone deliberately flips it, those keys keep working exactly as well as they always have, whether they're rotated regularly or sitting untouched in a forgotten .env file or an old CI/CD pipeline. ID Posture checks whether that door has actually been closed, on every scan.