Entra ID Auth for Cosmos DB is missing

[marvinbuss]

Cosmos DB Entra ID auth does not work today.

• You can set a credential here:

  Agents-for-python/libraries/microsoft-agents-storage-cosmos/microsoft_agents/storage/cosmos/cosmos_db_storage_config.py

  Line 65 in 9537e44

  self.credential: Union[TokenCredential, None] = credential

• The credential is also loaded here:

  Agents-for-python/libraries/microsoft-agents-storage-cosmos/microsoft_agents/storage/cosmos/cosmos_db_storage.py

  Lines 56 to 65 in 9537e44

  	if self._config.url:
  	if not self._config.credential:
  	raise ValueError(
  	storage_errors.InvalidConfiguration.format(
  	"Credential is required when using a custom service URL"
  	)
  	)
  	return CosmosClient(
  	account_url=self._config.url, credential=self._config.credential
  	)

• However, this entire section does not make sense:

  Agents-for-python/libraries/microsoft-agents-storage-cosmos/microsoft_agents/storage/cosmos/cosmos_db_storage.py

  Lines 56 to 65 in 9537e44

  	if self._config.url:
  	if not self._config.credential:
  	raise ValueError(
  	storage_errors.InvalidConfiguration.format(
  	"Credential is required when using a custom service URL"
  	)
  	)
  	return CosmosClient(
  	account_url=self._config.url, credential=self._config.credential
  	)

What is wrong about this section:

• You are referencing an account_url parameter, which does not exist. Reference: https://learn.microsoft.com/en-us/python/api/overview/azure/cosmos-readme?view=azure-python
• Connection policies, consistency levels and other configs are onl set for key authentication but not for Entra ID authentication:

  Agents-for-python/libraries/microsoft-agents-storage-cosmos/microsoft_agents/storage/cosmos/cosmos_db_storage.py

  Lines 67 to 69 in 9537e44

  	connection_policy = self._config.cosmos_client_options.get(
  	"connection_policy", documents.ConnectionPolicy()
  	)

• I also don't understand why you have a property in the config for the cosmos_db_endpoint and another one for the url. Those should be the same and you should just use one.

[marvinbuss]

If I configure the credential and url, I get the following error:

[rodrigobr-msft]

These are good callouts. We have a fix in https://github.com/microsoft/Agents-for-python/pull/283/files#diff-b3d87fd2e67354c662bcc6fd7ed79f3dbcedb88e8a04bb7fe9d6269d612cf792 to actually support the use of Azure credentials, but we will follow up with more work to simplify the API.

[MattB-msft]

@marvinbuss the fix for this should be out in 0.7.0.. can you confirm your sorted?

[MattB-msft]

Closing this as we believe its been completed.

[marvinbuss]

@MattB-msft I can confirm that this is working now. Sorry for not responding earlier!