Cosmos DB with private link not reacheble in Data Pipeline connection

[banto87]

Hi,

I have an Azure CosmosDB with private link (it is within a VNET). I have followed the doc to create a VNET data gateway for Fabric. The VNET Data gateway is successfully generated, and in the troubleshooting session it is able to solve Cosmos DNS and ping it. Now, in the Fabric Data Pipeline's Copy Data activity where I create the Azure Cosmos DB V2 connection it fails with message: Unable to create connection for the following reason: Unable to connect to the data source. Either the data source is inaccessible, a connection timeout occurred, or the data source credentials are invalid. Please verify the data source configuration and contact a data source administrator to troubleshoot this issue.

What can it be wrong?

[v-lgarikapat]

Hi @banto87 ,

Thanks for reaching out to the Microsoft fabric community forum.

1. Connection string mismatch: If you're using a private endpoint, make sure the connection string uses the correct FQDN  instead of the public endpoint. Using the wrong one can silently fail or time out.
2. Firewall or NSG rules: Double-check that the subnet where the VNET Data Gateway is deployed is explicitly allowed in the CosmosDB firewall settings. Even if DNS resolves, CosmosDB might still block traffic from unauthorized subnets.
3. Private DNS zone linkage: If you're using a private DNS zone for CosmosDB, ensure it's correctly linked to the VNET where the gateway resides. Misconfigured DNS zones can cause resolution to succeed but route traffic incorrectly.
4. Sub-resource mismatch: When creating the private endpoint, ensure the target sub-resource is set to Sql or SqlDedicated depending on your CosmosDB API. If this is misaligned, the connection will fail silently.
5. Gateway region mismatch: The VNET Data Gateway and the Fabric workspace should ideally be in the same region. Cross-region traffic can introduce latency or even fail due to policy restrictions.
6. Authentication issues: If you're using managed identity or service principal, confirm that the identity has the correct role (like Cosmos DB Account Reader Role) on the CosmosDB account.

Configure virtual network based access for an Azure Cosmos DB account | Microsoft Learn

On-premises and virtual network (VNet) data gateways documentation | Microsoft Learn

Best Regards,

Lakshmi Narayana

[banto87]

@v-lgarikapat thanks.

Unfortunately those suggestions do not help me to succeed.

One note though: the VNET is in North EU while I see that Fabric shows the message: Your data is stored in Switzerland North (Zurich)

Is this what you mean in point 5 maybe?

[banto87]

Hi,

I have an Azure CosmosDB with private link (it is within a VNET). I have followed the doc to create a VNET data gateway for Fabric. The Data gateway is successfully generated, and in the troubleshooting option it is able to solve Cosmos DNS and ping it. Now, in the Fabric Data Pipeline's Copy Data activity where I create the Azure Cosmos DB V2 connection it fails with message: Unable to create connection for the following reason: Unable to connect to the data source. Either the data source is inaccessible, a connection timeout occurred, or the data source credentials are invalid. Please verify the data source configuration and contact a data source administrator to troubleshoot this issue.

What can it be wrong?