Azure Cosmos DB for NoSQL in Python: identity auth needs the data-plane role

TL;DR

Use identity; keep keys for break-glass. - Partition key. Check metrics before raising; often the query needs a partition-key filter. - enablecrosspartition_query.

Steps

1. ```python

from azure.identity import DefaultAzureCredential from azure.cosmos import CosmosClient

cred = DefaultAzureCredential() client = CosmosClient("https://YOUR-ACCOUNT.documents.azure.com:443/", credential [your value] db = client.getdatabaseclient("[db]") container = db.getcontainerclient("[container]") for item in container.queryitems("SELECT * FROM c", enablecrosspartitionquery=True): print(item["id"])

2. - **Data-plane RBAC.** Subscription Contributor does not read documents. Assign a Cosmos DB built-in data role (e.g. "Cosmos DB Built-in Data Contributor") with:
 `az cosmosdb sql role assignment create --account-name [account] -g [rg] --role-name "Cosmos DB Built-in Data Contributor" --principal-id [object-id] --scope /`
 Without it you get 403 Forbidden on every data call while management calls work fine.
- **Keys vs identity.** `CosmosClient(url, key)` with the primary key works, but keys are full-access and rotation breaks you. Use identity; keep keys for break-glass.
- **Partition key.** Every container needs a partition key path at creation. There is no good default; `/id` is fine for small workloads, a real tenant/user key for large ones. You cannot change it later without migrating.
- **RU/s.** Default 400 RU/s on a new container. Cross-partition queries on big containers eat it fast and 429. Check metrics before raising; often the query needs a partition-key filter.
- **enable_cross_partition_query.** Required for queries that span partitions in the SDK; without it you get an error, not wrong results.

3. Verify: point-read one item by id + partition key (1 RU-ish), then run your query and watch the request charge in the response headers.

## When to use

You are seeing this: Subscription Contributor does not read documents. Use this skill when you run into "Azure Cosmos DB for NoSQL in Python: identity auth needs the data-plane role".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

## Sources

- https://YOUR-ACCOUNT.documents.azure.com:443/"

Proactive skill. CosmosClient identity pattern and data-plane role assignment verified against current docs. Evidence: https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/quickstart-python