This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 34%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
I'm experiencing an issue accessing data in Azure Cosmos DB through the Azure Portal.
When I try to view the data, I receive the following error:
Authorization header doesn't conform to the required format. Please verify and try again. ActivityId: 30f82013-4493-4714-9a6f-85880e06e9b2 OS: Windows/10.0.20348 SDK: cosmos-netstandard-sdk/3.18.0
In Access Control (IAM), I am assigned to a group with the Reader role. However, I am unable to read the database data.
What’s confusing is that I can access data in another Cosmos DB instance using the same access control group without any issues.
Has anyone encountered this before? Is there an additional role (such as Cosmos DB built-in data roles) required to read data from the Data Explorer?
An Azure NoSQL database service for app development.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 24%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPP%3C/text%3E%3C/svg%3E)
Hi Ghazy Prihanda,
Thank you for reaching out Microsoft Q&A!.
Based on the error message and the information provided, this behavior is expected and is related to the separation between management-plane RBAC and data-plane RBAC in Azure Cosmos DB.
The Reader role assigned through Azure IAM grants permission to view and manage the Cosmos DB account resource at the management plane level. However, it does not provide permission to read data inside databases and containers.
When you open Data Explorer, the Azure portal attempts to access data using data-plane authorization with Azure AD. Since no Cosmos DB data role is assigned to your user or group, the request is rejected and results in the error stating that the authorization header does not conform to the required format. Although the message refers to the authorization header, the root cause is missing data-plane permissions rather than an issue with the token format.
The reason it works in another Cosmos DB account is likely because that account already has a Cosmos DB Built-in Data Reader or Contributor role assigned, or local authentication using account keys is enabled and being used.
To resolve this issue, please assign a Cosmos DB built-in data role such as Cosmos DB Built-in Data Reader for read-only access or Cosmos DB Built-in Data Contributor if write access is required. The role can be assigned at the account level, or scoped to a specific database or container. After assigning the role, allow a few minutes for propagation and then refresh Data Explorer.
If local authentication has been disabled in the Cosmos DB account settings, assigning a data-plane role becomes mandatory for accessing data through Azure AD.
In summary, the Azure Reader role alone is not sufficient to access data in Data Explorer. A Cosmos DB data-plane role assignment is required.
Please let us know if you need further assistance.
Hi Ghazy Prihanda,
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 95%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
Hi Ghazy Prihanda, I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 62%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERE%3C/text%3E%3C/svg%3E)
I'm having the exact same issue.
I have already assigned the "Cosmos DB Built-in Data Reader" role using Azure CLI:
COSMOS_ROLE="Cosmos DB Built-in Data Reader"
COSMOS_ROLE_ID=$(az cosmosdb sql role definition list --account-name "$COSMOS_ACCOUNT" --resource-group "$COSMOS_RG" --query "[?roleName == '$COSMOS_ROLE'].id | [0]" -o tsv)
az cosmosdb sql role assignment create --account-name "$COSMOS_ACCOUNT" --resource-group "$COSMOS_RG" --scope "/" --principal-id "$OBJECT_ID" --role-definition-id "$COSMOS_ROLE_ID"
In addtion to this I have assigned a custom role to the Azure RBAC of the Cosmos account with these actions:
"Microsoft.DocumentDB/databaseAccounts/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/read"
I can verify this works by querying a database for containers, which completes successfully.
az cosmosdb sql container list --account-name "$COSMOS_ACCOUNT" --resource-group "$COSMOS_RG" --database-name "$COSMOS_DB"
But I am unable to view any items, unless I specify the ?feature.enableAadDataPlane=true as suggested by @Saraswathi Devadula
But this is hardly a long-term solution, especially not for our developers looking to browse Cosmos using the VS Code extension
Hi Ghazy Prihanda,
The problem goes away if you append feature.enableAadDataPlane to the url query string, i.e navigate to https://cosmos.azure.com/?feature.enableAadDataPlane=true and it will work.
Please do let me know if you have any further queries. I am happy to assist you.