Before You Connect

Ensure that the Azure identity has the correct role assignment. For Azure AD authentication, the identity is the account that you use to log into the browser. For Azure Service Principal authentication, the identity is the Application itself.

You can either create your own custom role definitions, or assign one of the built-in role definitions:

• CosmosDB Built-in Data Reader
• CosmosDB Built-in Data Contributor

You must also set the scope of the role assignment, where "/" means that the identity has access to all the databases.

For details, see Configure role-based access control for your Azure Cosmos DB account with Azure AD.