How to create a custom role for secondary user in CosmosDB for MongoDB vCore

Question

I am trying to create a custom role that grants readWrite access to database. I am doing it to assign read write permissions to a specific database. The inbuilt role readWriteAnyDatabase grants read write access to all the database so I can not use this. I tried running the below command, but it seems like this command does not work for MongoDB vCore resource. I am looking for an option to create a custom role.

az cosmosdb mongodb role definition create \

--resource-group "NRK" \

--account-name "nrkmongocluster" \

--body '{

    "Id": "test.My_Read_Only_Role101",

    "RoleName": "My_Read_Only_Role101",

    "Type": "CustomRole",

    "DatabaseName": "test",

    "Privileges": [

        {

            "Resource": {

                "Db": "test",

                "Collection": "test"

            },

            "Actions": ["insert", "find"]

        }

    ],

    "Roles": []

}'

Answer 1

Hi there Nagarjun kondapalli

I think cosmos DB for MongoDB vCore currently doesn’t support creating custom roles through the Azure CLI — that feature is only available in the NoSQL API. In vCore, role management is handled natively by the MongoDB engine, so you’ll need to connect directly to the cluster and use MongoDB commands like db.createRole() to define custom roles scoped to a specific database. The CLI command you tried works for the API for MongoDB (serverless/provisioned throughput), not for vCore. So the path forward is to create roles directly inside MongoDB shell or driver.

If this helps kindly accept the answer thanks much.