Cosmos DB with private link not reacheble in Data Pipeline connection

[banto87]

Hi,

I have an Azure CosmosDB with private link (it is within a VNET). I have followed the doc to create a VNET data gateway for Fabric. The VNET Data gateway is successfully generated, and in the troubleshooting session it is able to solve Cosmos DNS and ping it. Now, in the Fabric Data Pipeline's Copy Data activity where I create the Azure Cosmos DB V2 connection it fails with message: Unable to create connection for the following reason: Unable to connect to the data source. Either the data source is inaccessible, a connection timeout occurred, or the data source credentials are invalid. Please verify the data source configuration and contact a data source administrator to troubleshoot this issue.

What can it be wrong?

[v-lgarikapat]

Hi @banto87 ,

Thanks for reaching out to the Microsoft fabric community forum.

1. Connection string mismatch: If you're using a private endpoint, make sure the connection string uses the correct FQDN  instead of the public endpoint. Using the wrong one can silently fail or time out.
2. Firewall or NSG rules: Double-check that the subnet where the VNET Data Gateway is deployed is explicitly allowed in the CosmosDB firewall settings. Even if DNS resolves, CosmosDB might still block traffic from unauthorized subnets.
3. Private DNS zone linkage: If you're using a private DNS zone for CosmosDB, ensure it's correctly linked to the VNET where the gateway resides. Misconfigured DNS zones can cause resolution to succeed but route traffic incorrectly.
4. Sub-resource mismatch: When creating the private endpoint, ensure the target sub-resource is set to Sql or SqlDedicated depending on your CosmosDB API. If this is misaligned, the connection will fail silently.
5. Gateway region mismatch: The VNET Data Gateway and the Fabric workspace should ideally be in the same region. Cross-region traffic can introduce latency or even fail due to policy restrictions.
6. Authentication issues: If you're using managed identity or service principal, confirm that the identity has the correct role (like Cosmos DB Account Reader Role) on the CosmosDB account.

Configure virtual network based access for an Azure Cosmos DB account | Microsoft Learn

On-premises and virtual network (VNet) data gateways documentation | Microsoft Learn

Best Regards,

Lakshmi Narayana

[banto87]

@v-lgarikapat thanks.

Unfortunately those suggestions do not help me to succeed.

One note though: the VNET is in North EU while I see that Fabric shows the message: Your data is stored in Switzerland North (Zurich)

Is this what you mean in point 5 maybe?

[v-lgarikapat]

Hi @banto87 

Thanks for following up. Here are a few learning documents and previously solved threads that may help you understand and resolve the issue

For reference 

Configure Azure Private Link for Azure Cosmos DB | Microsoft Learn

Configure virtual network based access for an Azure Cosmos DB account | Microsoft Learn

Use virtual network data gateway with Pipeline in Fabric | Microsoft Learn

Solved: Using VNET Gateway for data pipelines in fabric - Microsoft Fabric Community

Solved: VNet Data Gateway - Power BI Tenant in one region,... - Microsoft Fabric Community

Solved: Using a VNet gateway with Notebooks - Microsoft Fabric Community

New Features and Enhancements for Virtual Network Data Gateway | Microsoft Fabric Blog | Microsoft F...

Best Regards,

Lakshmi Narayana

[banto87]

@v-lgarikapat thanks. I've followed all instructions. Now I have Cosmos DB and its private EP in the same region as Fabric tenant and still get a connectivity error from the Copy Data activity in Fabric:

Please suggest.

[v-lgarikapat]

Hi @banto87 ,

Based on the screenshot you shared, here are a few troubleshooting steps: 

Since you already put Cosmos DB and the private endpoint in the same region as your Fabric tenant, next make sure you're using the private FQDN in your Fabric connection (not the public one) and check that the private DNS zone (privatelink.documents.azure.com) is linked to the VNET with your data gateway try doing an nslookup from a VM in that VNET to confirm it's resolving to a private IP. Also, if you're using Managed Identity, give it access to Cosmos DB by assigning the right role like Reader or Contributor. The SSL certificate error may come up if the Fabric gateway can't validate the Cosmos DB certificate, especially if it's using a public CA the runtime can’t reach so as a test, try enabling the skip certificate validationcheckbox in your connection settings (but only temporarily). Also double-check that the Cosmos private endpoint is created for the correct subresource depending on the API you’re using (like Sql or SqlDedicated). If everything seems right but still fails, try recreating the Cosmos DB connection in Fabric from scratch, making sure you test the connection before saving. Let me know if you want help checking DNS from a VM or reviewing your JSON connection config.

Configure Azure Private Link for Azure Cosmos DB | Microsoft Learn

Configure Azure Cosmos DB for NoSQL in a copy activity - Microsoft Fabric | Microsoft Learn

Azure Private Endpoint DNS Integration Scenarios | Microsoft Learn

Best Regards,

Lakshmi Narayana

[banto87]

hello,

can you pls elaborate more on how this can be done: "try enabling the skip certificate validationcheckbox in your connection settings (but only temporarily)"

thanks

[v-lgarikapat]

Hi @banto87 ,

Thanks for the follow up

To enable the Skip certificate validation option in Microsoft Fabric when setting up a Cosmos DB connection, head to your Fabric workspace and open the Manage connections and gateways section. Either edit your existing connection or start creating a new one, and once you reach the configuration screen, select your preferred authentication method like Managed Identity and look for the advanced settings or security options. There, you’ll find a checkbox labeled something like Skip server certificate validation. Check that box to temporarily bypass SSL certificate checks, then test the connection to see if it resolves your issue. Just make sure to turn it off again once you've confirmed the root cause, since leaving it enabled can pose security risks in production environments

Best Rgards,

Lakshmi Narayana

[v-lgarikapat]

Hi @banto87 ,

I wanted to follow up and confirm whether you’ve had the opportunity to review the information we provided. Should you have any questions or require further clarification, please don't hesitate to reach out.

Best Regards,

Lakshmi Narayana

[v-lgarikapat]

Hi @banto87 ,

I wanted to follow up and confirm whether you’ve had the opportunity to review the information we provided. Should you have any questions or require further clarification, please don't hesitate to reach out.

Best Regards,

Lakshmi Narayana

[banto87]

Hi,

I have an Azure CosmosDB with private link (it is within a VNET). I have followed the doc to create a VNET data gateway for Fabric. The Data gateway is successfully generated, and in the troubleshooting option it is able to solve Cosmos DNS and ping it. Now, in the Fabric Data Pipeline's Copy Data activity where I create the Azure Cosmos DB V2 connection it fails with message: Unable to create connection for the following reason: Unable to connect to the data source. Either the data source is inaccessible, a connection timeout occurred, or the data source credentials are invalid. Please verify the data source configuration and contact a data source administrator to troubleshoot this issue.

What can it be wrong?