Azure Cosmos DB for NoSQL in Node.js: @azure/cosmos with identity

import { CosmosClient } from "@azure/cosmos";
import { DefaultAzureCredential } from "@azure/identity";

const client = new CosmosClient({
  endpoint: "https://YOUR-ACCOUNT.documents.azure.com:443/",
  aadCredentials: new DefaultAzureCredential(),
});
const { database } = await client.databases.createIfNotExists({ id: "[db]" });
const { container } = await database.containers.createIfNotExists({
  id: "[container]",
  partitionKey: "/tenantId",
});

Traps:

• aadCredentials, not credential. The option name in @azure/cosmos is aadCredentials. Passing credential silently does nothing and you get auth errors.
• Data-plane role. "Cosmos DB Built-in Data Contributor" via az cosmosdb sql role assignment create. Same 403-without-it story.
• createIfNotExists is your friend. Databases and containers: create-if-not-exists in setup code avoids 404/409 races in fresh environments.
• Partition key on every write. Point operations need both id and partition key value. Forgetting the partition key value on container.item(id, pk).read() is the classic 404-that-is-not-a-404.

Verify: write one item, point-read it back, then run a query and log the request charge.