I cannot access the data in my CosmosDB, but I am an Owner

Question

I cannot access the data in my CosmosDB, but I am an Owner

Shaun Blackham (Insight Global LLC) 65 Microsoft External Staff

I have both the owner role and Cosmos DB Data Contributor role for my CosmosDB instance. I cannot access the read or write abilities I should be able to.

CosmosDBpermissions1

CosmosDBReadError1

Error:

Request blocked by Auth xxxxx : Request is blocked because principal <myPrincipal> does not have required RBAC permissions to perform action [Microsoft.DocumentDB/databaseAccounts/readMetadata] on resource [/]. Learn more: https://aka.ms/cosmos-native-rbac. This could be because the user's group memberships were not present in the AAD token.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello Shaun Blackham (Insight Global LLC),

The issue occurs because Azure RBAC Owner access does not automatically grant Cosmos DB data access.

Roles like Owner, Contributor, Cosmos DB Operator, or DocumentDB Account Contributor are control-plane roles used to manage the Cosmos DB account, but they do not include the required data-plane permission:

Microsoft.DocumentDB/databaseAccounts/readMetadata

This permission is required to read and write data and is included only in Cosmos DB built-in data roles.

Since the error specifically mentions readMetadata, please verify that the principal (user, group, service principal, or managed identity) has one of the following Cosmos DB built-in data roles assigned at the account scope (/):

Cosmos DB Built-in Data Reader 00000000-0000-0000-0000-000000000001
Cosmos DB Built-in Data Contributor 00000000-0000-0000-0000-000000000002

Example using Azure CLI:

az cosmosdb sql role assignment create \
  --resource-group <resource-group> \
  --account-name <cosmos-account> \
  --scope "/" \
  --principal-id <user-object-id> \
  --role-definition-id "00000000-0000-0000-0000-000000000002"

This should resolve the “Request blocked by Auth xxxxx” error.