# Steps to create a custom role with RBAC permissions on Azure to manage an Azure Cosmos DB for NoSQL account.

**URL:** <https://community.cdata.com/t/steps-to-create-a-custom-role-with-rbac-permissions-on-azure-to-manage-an-azure-cosmos-db-for-nosql-account/910>\
**Category:** Data Sources\
**Tags:** cosmosdb, article, azure, azure-cosmos-db\
**Created:** [October 4, 2024, 9:50pm UTC](https://community.cdata.com/t/steps-to-create-a-custom-role-with-rbac-permissions-on-azure-to-manage-an-azure-cosmos-db-for-nosql-account/910 "2024-10-04T21:50:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dorando\_Myslimi](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@Dorando\_Myslimi](https://community.cdata.com/u/Dorando_Myslimi)\
**Post date:** [October 4, 2024, 9:50pm UTC](https://community.cdata.com/t/steps-to-create-a-custom-role-with-rbac-permissions-on-azure-to-manage-an-azure-cosmos-db-for-nosql-account/910/1 "2024-10-04T21:50:55Z")

</div>

Sometimes clients face permission errors while trying to authenticate using **‘Azure AD’** or **‘Azure Service Principal’** AuthScheme with our CosmosDB driver. One of them is the **RBAC** (_role-based access control_) error permission:

**java.sql.SQLException: [Forbidden] Request blocked by …: Request for Read DatabaseAccount is blocked because principal [\*\*\*\*\*\*] does not have required RBAC permissions to perform action** **[Microsoft.DocumentDB/databaseAccounts/readMetadata] on any scope. Learn more: [Search - Microsoft Bing](https://aka.ms/cosmos-native-rbac.)**

This kind of error is typically thrown due to some role missing. The main issue here is that this role isn’t available to be configured from the UI just like we can configure other roles. The only way to add it, based on the [API Documentation](https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-control-plane-role-based-access?tabs=built-in-definition%2Ccsharp&pivots=azure-interface-cli) is by creating a custom role with the following RBAC permission (_ **Microsoft.DocumentDB/databaseAccounts/readMetadata** _) from Cloud Shell which then will be assigned to an identity so that our applications can access resources in Azure Cosmos DB.

Follow the steps below to create a custom role with the necessary RBAC permission.

1- You have to create a JSON file on your computer and inside the file save one of the following roles: [ReadOnlyRole](https://learn.microsoft.com/en-us/cli/azure/cosmosdb/sql/role/definition?view=azure-cli-latest#az-cosmosdb-sql-role-definition-create:~:text=%5B--no-wait%5D-,Examples,-Create%20a%20SQL) or [ReadWriteRole](https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-control-plane-role-based-access?tabs=custom-definition%2Ccsharp&pivots=azure-interface-cli)

 ![ee772c1c-1c10-442f-99e5-dc676ffa224c.png](https://us1.discourse-cdn.com/cdata/original/1X/7430405b1f121018ccf899781264e5742db7118c.png)

_In my example, I tried to create a_ _ **ReadOnlyRole** __._&nbsp;  
&nbsp;  
2- After creating the file, log in to _[https://portal.azure.com](https://portal.azure.com)_ and open **Cloud Shell** (_I would recommend switching it to_ _ **Bash** _)

 ![960bd7c9-291c-4b4d-830a-dc98f5a026c0.png](https://us1.discourse-cdn.com/cdata/original/2X/0/0478071003a397d0721e1221197f7a9ed1a59143.png)

3- Upload the JSON file that you created from your computer.

 ![d9277077-93ae-41ab-b7ed-ecca7a663c5e.png](https://us1.discourse-cdn.com/cdata/original/1X/571f2099cdd8cf3b6e27863b3d7fc333a83d4e48.png)

4- Next, you must run the following commands one by one to create this role.

- **resourceGroupName=‘\<myResourceGroup\>’ \***

- **accountName=‘\<myCosmosAccount\>’ \*\***

- **az cosmosdb sql role definition create --account-name $accountName --resource-group $resourceGroupName --body @role-definition-ro.json \*\*\***

_\* - Set it to the_ _ **Resource group**  **name** _ _that you want this role to be created on._&nbsp;  
_\*\* - Set it to the_ _ **Azure Cosmos DB** _ _account you want to work with._&nbsp;  
_\*\*\* - Set the name of the JSON file that you created and uploaded._

 ![37bd4df2-2587-4230-ba63-32e6ec362d7e.png](https://us1.discourse-cdn.com/cdata/original/2X/f/f06e1117cd88c460145a6faf1eaca34165918aa6.png)

5- After everything is executed successfully, the following data will be displayed where you have to copy the **name** value since it will be needed in the next step.

 ![49a89bfc-ed23-423b-aac5-9e2ba0160eef.png](https://us1.discourse-cdn.com/cdata/original/1X/c6b7f405f0e365cae0c4e7ca7c9ff25661d11b6c.png)

6- Next, execute the following commands one by one.

- **readOnlyRoleDefinitionId=‘\<roleDefinitionId (_the value that you copied above_)\>’** _#If you are creating read-only role use_ _readWriteRoleDefinitionId_

- **principalId=‘\<PrincipalId\>’** _Note: In most cases, this is the PrincipalId displayed in the error message_.

- **az cosmosdb sql role assignment create -a $accountName -g $resourceGroupName -s “/” -p $principalId -d $readOnlyRoleDefinitionId** _#If you are creating a read-only role run the following command_ _az cosmosdb sql role assignment create -a $accountName -g $resourceGroupName -s “/” -p $principalId -d $readwriteRoleDefinitionId_

 ![c2e2a659-9e0b-48a1-a1bf-a93b91fd6633.png](https://us1.discourse-cdn.com/cdata/original/1X/04e67703c5a930f6216afb12147dbc4a5ee615ab.png)

Next in our CosmosDB driver you just have to set the necessary connection properties that are related to the AzureAD or AzureServicePrincipal AuthScheme (_Depending on which you want to work with_).