Error text: `403 Forbidden` on document operations while account management works.
Triage in order:
1. **Identity without data role.** If using DefaultAzureCredential / aadCredentials, the identity needs a Cosmos DB data-plane role: `az cosmosdb sql role assignment create --account-name [account] -g [rg] --role-name "Cosmos DB Built-in Data Contributor" --principal-id [oid] --scope /`. Subscription Contributor is irrelevant here.
2. **IP firewall.** Account networking set to "selected networks" and your client IP is not allow-listed. Portal shows allowed IPs; add yours or use a private endpoint.
3. **disableLocalAuth.** If the account has local (key) auth disabled and your code passes a key, every call 403s. Switch the code to identity.
4. **Partition key mismatch on point reads.** `container.item(id, wrongPk).read()` can surface as 404, but combined with firewall/RBAC confusion it gets misdiagnosed as 403. Rule it out with a known-good point read.
Confirm which: run the same operation from the portal's Data Explorer (uses its own auth path). If Data Explorer works, the account is fine and the problem is your client's auth or network. If Data Explorer also 403s, it is the account firewall or RBAC.