Azure-docs: Need to add CosmosDB support of Managed Identities

[guillermoarellano]

Hi,

Based on the latest post on March 4, 2019, it appears that CosmosDB now supports system-assigned Managed Identities. https://feedback.azure.com/forums/263030-azure-cosmos-db/suggestions/33896353-support-msi-managed-service-identity-direct-acce

Please update the document with this information. Also, please look into the user-assigned identities status for CosmosDB.

Thanks,
Guillermo Arellano

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 726adac9-1848-01a6-9586-842c81f820f7
• Version Independent ID: 249db438-8c95-8e69-f69e-8e48fcd0b359
• Content: Azure Services that support managed identities for Azure resources
• Content Source: articles/active-directory/managed-identities-azure-resources/services-support-managed-identities.md
• Service: active-directory
• Sub-service: msi
• GitHub Login: @MarkusVi
• Microsoft Alias: priyamo

[Karishma-Tiwari-MSFT]

Thanks for the feedback! We are currently investigating and will update you shortly.

[shashishailaj]

@guillermoarellano We are assigning this to the author for reviewing this request.

@MarkusVi @priyamohanram Could you please get this reviewed with the engineering and have this page updated accordingly?

[arluca]

To clarify, CosmosDB does not support Azure AD authentication. They closed the feedback request, stating that you can use KeyVault as a jumping point for authenticating to CosmosDB. "

All of the services that support managed identity (e.g. VM, Function, App Service, etc) use Azure AD tokens, to authenticate to services like Storage, Key Vault, etc.

[MarkusVi]

please-close

[crgarcia12]

There is a trick to do it:
You can use the Azure Resource API to get the connection string using MSI.
Example in pseudo-python:

from msrestazure.azure_active_directory import MSIAuthentication
from azure.mgmt.resource import ResourceManagementClient
import requests
from pymongo import MongoClient

.........


        credentials = MSIAuthentication().token
        headers = {
            'Transfer-Encoding': 'chunked',
            'Authorization': 'Bearer ' + credentials["access_token"],
        }

        params = (
            ('api-version', '2015-04-08'),
        )

        response = requests.post('https://management.azure.com/subscriptions/<subid>/resourceGroups/<rg-name>/providers/Microsoft.DocumentDB/databaseAccounts/<cosmos-db>/listConnectionStrings', headers=headers, params=params)
        connection_string = json.loads(response.text)["connectionStrings"][0]["connectionString"]

..........

            client = MongoClient(connection_string)
            db=client.admin
            print(db.command("serverStatus"))

[estensen]

Can someone link the PR that fixed this? I've gone through most of the Cosmos DB docs and cannot find a code example.