Configuring Least Privilege Access in Azure Cosmos DB Using RBAC and Customer-Managed Keys

When designing a secure Azure Cosmos DB deployment, it is important to limit permissions to only what each principal needs. How can I use Azure role-based access control (RBAC) to define fine‑grained permissions and combine that with customer‑managed keys for encryption‑at‑rest to achieve a least‑privilege configuration? Please outline the steps, any required Azure AD groups or role definitions, and how to verify that the settings are enforced.