This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 12%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
In the Azure Portal, when I try to access the container items in data explorer for the Cosmos DB account,
I am getting the following error :
Local Authorization is disabled. Use an AAD token to authorize all requests.
I gave myself the Cosmos DB Account Reader Role and Contributor Role. But I am still not able to access the data.
We have a policy enforced so I cannot enable Local Authorization. What should I do in order to access the Cosmos DB data?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 1%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Did you disable the StorageAccount SharedKey access?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 79%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Thanks for your question.
I have come across a similar error in this thread. Kindly verify if the solution provided in the thread is useful in your scenario.
I was able to get it working with the Azure Cosmos DB Explorer. However, while assigning roles (it has to be Custom Role) , I needed to make sure the roles were assigned at the Container Level(Scope) - /dbs/<db-name>/colls/<Container_Name>
To use the data explorer via the azure portal, the access keys must be activated.
Therefore, the following permissions must be available:
Microsoft.DocumentDB/databaseAccounts/listKeys/*
If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you.
@Patchfox I have given myself the Owner Role on the Cosmos DB resource. The Owner Role has the Microsoft.DocumentDB/databaseAccounts/listKeys/* permission. I am still not able to view the data in data explorer.
@Aayush Suresh Jain and you didn't disable the access keys in the storageAccount? Even with the permissions on the user, you won't be able to access the explorer via the portal. Because the portal needs for a lot of storageAccount requests the activated access keys.
Edit: but maybe the solution described in the other thread, could make it possible, to work without access key activation.
@Patchfox So, I also need to disable Storage Account Access Keys?
@Aayush Suresh Jain no, could have been a problem , if you have the access keys disabled. So, if the access keys feature is not disabled in the storageAccount, both solutions, described might work. I didnt test it yet
@Patchfox I have tried the other option in the thread. But that also is not allowing me to view the documents.
Request blocked by Auth cosmosdb : Request is blocked because principal does not have required RBAC permissions to perform action [Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery] on resource [dbs/Preferences/colls/UserPreference]. Learn more: https://aka.ms/cosmos-native-rbac.
I have setup myself with the required roles, but it is still not working for me.