Microsoft Discovery: Discovery Engine task execution fails with Cosmos DB authentication error (invalid_configuration)

Question

Microsoft Discovery: Discovery Engine task execution fails with Cosmos DB authentication error (invalid_configuration)

福森健人 0

We are evaluating Microsoft Discovery (workspace region: UK South) and Discovery Engine task execution consistently fails in our environment.

What we did

Created tasks with validation criteria and assigned agents in Discovery Studio (Workbench).
Attached the Storage Asset to the shared session.
Started the Discovery Engine (status: Active).
Instructed execution from a prompt, following the official demo deck steps.

Tasks are never processed, and the session returns the following error:


[foundry_server_error] HTTP 400 (ServiceError: invalid_configuration)

Authentication to the configured database failed. Please verify that your

Cosmos DB account credentials and managed identity configuration are correct.

Request ID: 4c94c8821755387858a48145d610d187

Our troubleshooting so far

The CogLoop container app (app-dwsp-cogloop-70ktwwaa) fails data-plane authentication to the Discovery-managed Cosmos DB (cosmos-dwsp-database-70ktwwaa, database aifsdata, container cogloop).
The CogLoop's AZURE_CLIENT_ID matches the Client ID of the Discovery-managed identity (mi-dwsp-identity-70ktwwaa), so the identity wiring looks correct.
The Cosmos DB account is inside the Discovery Network Security Perimeter (Enforced mode).
The Discovery control plane's SqlRoleAssignments/write operation on the Cosmos DB shows Succeeded.
Customer-side resources (user-assigned managed identity, Blob storage) work fine — chat sessions, agents, and containerized tool execution on the Supercomputer node pool all succeed. Only Engine-driven task execution fails.

All of the failing components are inside the managed resource group (mrg-dwsp-linkx-...), which customers cannot access or repair. We believe the CogLoop-to-Cosmos DB managed identity / data-plane role assignment / NSP configuration on the Discovery-managed side needs to be checked and fixed.

Additional observation (possibly related)

Supercomputer node pool cold start times are very inconsistent: ~40 minutes on one day, over 60 minutes without success on another, then a few minutes on a different session on the same day (Standard_D4s_v6, min 0 / max 2).

We can share the subscription ID, tenant ID, and full timestamps privately if a support engineer picks this up. Thank you.

Anshika Varshney 15,460 Reputation points Microsoft External Staff Moderator

2026-08-13T03:30:24.15+00:00

Hello @福森健人 ,

Thank you for the detailed information and troubleshooting steps you've already completed.

Based on the error message:

Authentication to the configured database failed. Please verify that your Cosmos DB account credentials and managed identity configuration are correct.

the issue appears to be occurring during Discovery Engine task execution when the service attempts to access its configured Cosmos DB backend. From the details provided, customer-managed resources such as agents, chat sessions, Blob storage access, and tool execution are functioning correctly, which suggests the problem may be isolated to the Discovery Engine's backend configuration or its access path to Cosmos DB.

To help narrow down the investigation, could you please confirm:

Whether the Cosmos DB account allows access from all required Microsoft-managed services involved in Discovery Engine execution.

If there are any Network Security Perimeter, firewall, private endpoint, or network access restrictions applied to the Cosmos DB account beyond those already mentioned.

Whether the issue persists when using a Cosmos DB account without NSP enforcement (for testing purposes only, if permitted by your security requirements).

The approximate timestamp (UTC) of a recent failed task execution and the associated Request ID.

Since this behavior appears to involve Microsoft Discovery managed components within the managed resource group, additional backend investigation may be required. Please share the above details, and we can continue the analysis.

Thank you.
Anshika Varshney 15,460 Reputation points Microsoft External Staff Moderator

2026-08-16T06:38:35.6366667+00:00

Hello @福森健人

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thankyou!

1 answer

Your answer

Anshika Varshney 15,460 Reputation points Microsoft External Staff Moderator

2026-08-13T03:30:24.15+00:00

Hello @福森健人 ,

Thank you for the detailed information and troubleshooting steps you've already completed.

Based on the error message:

Authentication to the configured database failed. Please verify that your Cosmos DB account credentials and managed identity configuration are correct.

the issue appears to be occurring during Discovery Engine task execution when the service attempts to access its configured Cosmos DB backend. From the details provided, customer-managed resources such as agents, chat sessions, Blob storage access, and tool execution are functioning correctly, which suggests the problem may be isolated to the Discovery Engine's backend configuration or its access path to Cosmos DB.

To help narrow down the investigation, could you please confirm:

Whether the Cosmos DB account allows access from all required Microsoft-managed services involved in Discovery Engine execution.

If there are any Network Security Perimeter, firewall, private endpoint, or network access restrictions applied to the Cosmos DB account beyond those already mentioned.

Whether the issue persists when using a Cosmos DB account without NSP enforcement (for testing purposes only, if permitted by your security requirements).

The approximate timestamp (UTC) of a recent failed task execution and the associated Request ID.

Since this behavior appears to involve Microsoft Discovery managed components within the managed resource group, additional backend investigation may be required. Please share the above details, and we can continue the analysis.

Thank you.
Anshika Varshney 15,460 Reputation points Microsoft External Staff Moderator

2026-08-16T06:38:35.6366667+00:00

Hello @福森健人

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thankyou!

Answer 1

Hello Anshika, thank you for the response.

Let me clarify and update the symptom, as we have narrowed it down further since the original post.

Updated symptom: automatic task creation by cognition does not work

When we manually create a task in the shared session and manually trigger it (clicking the task / instructing execution), the task now executes and completes.
However, the Discovery Engine's cognition never creates tasks automatically. According to the documentation (Discovery Engine overview, "Full delegation" pattern), cognition should decompose a high-level objective into child tasks and "create new tasks when it identifies gaps or opportunities." In our environment, no tasks are ever auto-generated — neither decomposition of a root task with a broad objective, nor gap-driven task creation while the Engine is Active.
We followed the official demo deck steps exactly (root task with a broad objective + validation requirements, agent available, Engine status Active, default chat model deployment present).

Since auto-created tasks would be written by the CogLoop container to the Discovery-managed Cosmos DB (account cosmos-dwsp-database-70ktwwaa, database aifsdata, container cogloop), we believe this is consistent with the Cosmos DB data-plane authentication error reported earlier ([foundry_server_error] HTTP 400, ServiceError: invalid_configuration). The write path used by cognition appears to be the broken component.

Regarding your questions 1–3 (Cosmos DB network/NSP configuration):

The Cosmos DB account in question is not a customer resource. It is provisioned and managed by Microsoft Discovery inside the managed resource group (mrg-dwsp-linkx-...), which customers cannot access or modify. We therefore cannot inspect or change its firewall, private endpoint, or NSP settings, and we cannot swap in a non-NSP Cosmos DB account for testing. All of these settings were configured by the Discovery service itself.

Regarding question 4 (timestamp and Request ID):

Failed execution (UTC): <YYYY-MM-DD HH:MM UTC>
Request ID: <request-id> (the earlier one was 4c94c8821755387858a48145d610d187)

Given that every failing component lives in the Microsoft-managed resource group, we believe backend investigation by the Discovery engineering team is required — specifically the CogLoop managed identity's data-plane role assignment and the NSP configuration on the managed Cosmos DB. Could you please escalate this to the backend team? We are happy to share the subscription ID, tenant ID, and workspace details through a private channel.

Thank you.