Permissions required to update a comos db document.

Hi Saurabh Sharma,
Thank you for reaching out to Microsoft Q&A.

• Cosmos DB Built-in Data Contributor role (data-plane)
  Please go with the Cosmos DB Built-in Data Contributor role (data-plane) at the correct scope to update documents.
  like:
• Data-plane actions:
  • Microsoft.DocumentDB/databaseAccounts/read
  • Microsoft.DocumentDB/databaseAccounts/listKeys/action
  • Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/* (covers replace, upsert, delete, read for documents)
• CRUD operations on items within containers.
• Query execution on containers.

This role does NOT allow account-level management (control-plane) but enables full document-level operations.
reference: https://free.blessedness.top/azure/cosmos-db/how-to-setup-rbac#built-in-role-definitions

“Cosmos DB Operator” won’t let you modify documents — it’s a control-plane role (manage the account) and explicitly blocks data access and even the account keys/connection strings.

To update a document, you need a data-plane permission. The simplest built-in choice is Cosmos DB Built-in Data Contributor assigned at the right scope (account / database / container). That role includes the item actions needed to update (replace/upsert) documents, e.g. …/containers/items/replace, …/containers/items/upsert, and the usual CRUD/query actions.

Quick path (pick one):

Entra ID / RBAC (recommended) – Assign “Cosmos DB Built-in Data Contributor” to your user/app at the container (or db/account) scope. After that, connect with Entra ID and you can update documents.

Key-based auth (legacy) – Use a key that has write rights; note the Operator role cannot view or regenerate keys, by design. If you’re going this route, someone with a role that allows listKeys must fetch the key for you.

If you still get a 403 after the assignment, double-check the scope (container vs database), and that your client is actually using Entra ID (not an old connection string). The data-plane role’s ID for “Built-in Data Contributor” is listed in the docs if you prefer scripting assignments.

Hope that clarifies which permission you need.