identify the permission you need to assign to ensure that ContosoLOB is able to accomplish the above requirements
You need to ensure that the certificate used to encrypt data can be accessed by the cloud service application