Cosmos Db error : Request blocked by Auth

Question

Hi,

I can not read the data in Cosmos Dbs in all Azure Directories.
Here is the error message:
Request blocked by Auth : Request is blocked because principal [] does not have required RBAC permissions to perform action [Microsoft.DocumentDB/databaseAccounts/readMetadata] on resource [/]. Learn more: https://aka.ms/cosmos-native-rbac.

My IP is whitelisted.

I have the Owner role.

Users with the same role can read the data in the same CosmosDb.

Answer 1

Hi Eng. Mahdi Poodineh ,

Thanks for the question and using MS Q&A platform.

Based on your inquiry, we understand that the issue arises because the user or service (referred to as the principal) lacks the necessary Role-Based Access Control (RBAC) permissions to execute the action Microsoft.DocumentDB/databaseAccounts/readMetadata on the specified resource. Even though the principal has the "Owner" role, this role may not encompass the required permissions for accessing data in Cosmos DB. To fix this problem, you need to ensure that the principal has the correct RBAC role that grants the necessary permissions. Here’s how to do that:
Check Current Role Assignments:-Confirm that the principal has the appropriate roles assigned. The "Owner" role may not cover all the data access permissions needed for Cosmos DB.

Assign the Necessary RBAC Roles:-Assign either the "Cosmos DB Built-in Data Reader" or "Cosmos DB Built-in Data Contributor" role to the principal. These roles provide the permissions required to read metadata and access data in Cosmos DB.

Steps to Assign the Required Roles

Go to the Azure Portal: Open the Azure portal and navigate to your Cosmos DB account.

Access Control (IAM):Click on Access Control (IAM) from the left-hand menu.

Add Role Assignment: Click on + Add > Add role assignment.
1.Choose either the "Cosmos DB Built-in Data Reader" or "Cosmos DB Built-in Data Contributor" role.
2.Assign the selected role to the principal (user or service) that requires access.

Example Command to Assign Role Using Azure CLI

az role assignment create --assignee <principal-id> --role "Cosmos DB Built-in Data Reader" --scope <cosmos-db-account-id>

1.Configure Role-Based Access Control with Microsoft Entra ID for Azure Cosmos DB:
This document provides detailed information on configuring RBAC for Cosmos DB. 
You can find it -https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac)..)

 2. Troubleshoot Forbidden Exceptions in Azure Cosmos DB:  This document provides troubleshooting steps for common forbidden exceptions in Cosmos DB. 
You can find it-(https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/troubleshoot-forbidden)..
By following these steps and ensuring the appropriate RBAC roles are assigned, you should be able to resolve the "Request blocked by Auth" error and access the data in Cosmos DB. If you need further assistance, feel free to ask!