Explanation
Box 1 = Randomized
Box 2 = Deterministic
Always Encrypted for Azure Cosmos DB supports two types of encryption: deterministic and randomized1.
Deterministic encryption always produces the same encrypted value for any given plain text value.
Randomized encryption produces a different encrypted value for the same plain text value.
For dateOfBirth, randomized encryption is the strongest type of encryption because it provides better protection against statistical analysis and brute-force attacks. Deterministic encryption would not be suitable for dateOfBirth because it could reveal patterns or allow equality comparisons1.
For healthStatus, deterministic encryption is the strongest type of encryption because it allows queries to perform equality comparisons and filters on the encrypted property. Randomized encryption would not be suitable for healthStatus because it would prevent any queries on the encrypted property1.

When DefaultTimeToLive is -1 then your Time to Live setting is On (No default) Time to Live on a container, if present and the value is set to "-1", it is equal to infinity, and items don't expire by default.
Time to Live on an item:
This Property is applicable only if DefaultTimeToLive is present and it is not set to null for the parent container.
If present, it overrides the DefaultTimeToLive value of the parent container.

Explanation
Azure Cosmos DB is a multi-model database that supports various data models, such as documents, key-value, graph, and column-family3. The core content-model of Cosmos DB's database engine is based on atom-record-sequence (ARS), which allows it to store and query different types of data in a flexible and efficient way3.
To optimize the data store for reading data, you should consider the following factors:
* The size and shape of your data
* The frequency and complexity of your queries
* The latency and throughput requirements of your application
* The trade-offs between storage efficiency and query performance
Based on these factors, one possible design that you could implement is B. In a company container, create a document for each company. Embed the users into company documents. Use the company ID as the partition key.
This design has the following advantages:
* It stores companies and users as self-contained documents that can be easily retrieved by company ID1.
* It avoids storing redundant data or creating additional containers for users1.
* It allows you to browse by company and browse the users by company with simple queries1.
* It shows a details page for the company and all the related users by fetching a single document1.
* It leverages the benefits of embedding data, such as reducing the number of requests, improving query performance, and simplifying data consistency2.
This design also has some limitations, such as:
* It may not be suitable for some users who have data that is greater than 2 KB, as it could exceed the
* maximum document size limit of 2 MB2.
* It may not be optimal for scenarios where users need to be associated with more than one company or queried independently from companies2.
* It may not be scalable for companies that have more than 1,000 users, as it could result in hot partitions or throttling2.
Depending on your specific use case and requirements, you may need to adjust this design or choose a different one. For example, you could use a hybrid data model that combines embedding and referencing data2
, or you could use a graph data model that expresses entities and relationships as vertices and edges.

Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/provision-account-continuous-backup