You can add a cloud account by using the express configuration wizard or the custom configuration wizard.
Key-based (local) authentication for the account must be enabled for Cosmos DB backups to complete successfully. Therefore, the disableLocalAuth property must be set to false. For instructions about configuring this setting, refer to the Microsoft documentation for Azure Cosmos DB.
You can set up the backup gateway within a shared infrastructure subscription and assign the appropriate RBAC permissions to it across the target subscriptions where the Cosmos DB accounts reside.