Cosmos DB's other APIs and Azure DocumentDB

Azure DocumentDB with Microsoft Entra

1. Allow Entra alongside native users first (keep NativeAuth until Entra sign-in works): authConfig.allowedModes: ['NativeAuth', 'MicrosoftEntraID'] on Microsoft.DocumentDB/mongoClusters (the documentdb CLI extension's mongocluster update takes --auth-allowed-modes).
2. Register each principal as a cluster user: a Microsoft.DocumentDB/mongoClusters/users resource named <cluster>/users/<object id>, with identityProvider.type: MicrosoftEntraID, a principalType and roles such as {"db": "sales", "role": "readWrite"}, readAnyDatabase, readWriteAnyDatabase with clusterAdmin, or {"db": "admin", "role": "root"}.
3. Connect with MONGODB-OIDC; the token audience is the same as PostgreSQL's and MySQL's, https://ossrdbms-aad.database.windows.net/.default.

import { MongoClient, type OIDCCallbackParams, type OIDCResponse } from "mongodb";
import { DefaultAzureCredential, type TokenCredential } from "@azure/identity";

const SCOPE = "https://ossrdbms-aad.database.windows.net/.default"; // same audience as PostgreSQL and MySQL

async function entraToken(_params: OIDCCallbackParams, credential: TokenCredential): Promise<OIDCResponse> {
  const t = await credential.getToken(SCOPE);
  if (!t) throw new Error("no token");
  return { accessToken: t.token, expiresInSeconds: Math.floor((t.expiresOnTimestamp - Date.now()) / 1000) };
}

const credential = new DefaultAzureCredential();

// The identity must be registered as a cluster user (mongoClusters/users) with a role such as readWrite on the database.
export const client = new MongoClient(`mongodb+srv://${process.env.DOCUMENTDB_CLUSTER}.global.mongocluster.cosmos.azure.com/`, {
  tls: true,
  retryWrites: true,
  connectTimeoutMS: 120_000,
  authMechanism: "MONGODB-OIDC",
  authMechanismProperties: {
    OIDC_CALLBACK: (params: OIDCCallbackParams) => entraToken(params, credential),
    ALLOWED_HOSTS: ["*.azure.com"],
  },
});

export async function main(): Promise<void> {
  await client.connect();
  const orders = client.db("shop").collection<{ _id: string; customerId: string; total: number }>("orders");
  await orders.updateOne({ _id: "o-1001" }, { $set: { customerId: "c-42", total: 12.5 } }, { upsert: true });
  console.log(await orders.findOne({ _id: "o-1001" }));
  await client.close();
}

Deleting a principal in Entra doesn't remove the cluster user, and issued tokens stay valid until they expire (up to about 90 minutes): delete the users/<object id> resource to revoke at once. Storage can grow but never shrink. Some server-side MongoDB extensions and storage engines aren't supported.

Cosmos DB for MongoDB (RU)

Endpoints are <account>.mongo.cosmos.azure.com (3.6 and later; 3.2 accounts used documents.azure.com), TLS 1.2. Its RBAC (users and roles, 3.6+) is managed only with the CLI or PowerShell.

Cosmos DB for Table

Has its own native data-plane roles, like NoSQL and distinct from Azure RBAC: Built-in Data Reader (…0001: readMetadata, entity read) and Built-in Data Contributor (…0002: tables/*, tables/containers/entities/*); readMetadata must always be allowed for SDK clients, and notDataActions isn't supported. Table storage in a storage account is a different service: reference/storage/tables.md.