What causes DF-Cosmos-InvalidAccountKey?

The Cosmos DB account's primary or secondary key was regenerated in the Azure portal and the linked service was not updated with the new key. The account key in the linked service was truncated, corrupted, or has extra whitespace from a manual copy-paste. The linked service references the read-only key but the data flow requires a read-write key for write operations

How do I fix DF-Cosmos-InvalidAccountKey?

Open the Azure portal and go to your Cosmos DB account → Keys.. Copy the full Primary key (or Secondary key as a fallback) — ensure no trailing spaces or line breaks are included.. Open the Cosmos DB linked service in ADF Studio, update the account key field with the copied value, and click 'Test connection' to verify.. If the pipeline performs write operations, confirm you are using a read-write key (not the read-only key shown in a separate section on the Keys page).

Medium severitydata source

Power BI Refresh Error:
DF-Cosmos-InvalidAccountKey

What does this error mean?

The ADF Mapping Data Flow Cosmos DB linked service contains an invalid account key. The key stored in the linked service does not match any active key on the Cosmos DB account.

Common causes

1The Cosmos DB account's primary or secondary key was regenerated in the Azure portal and the linked service was not updated with the new key
2The account key in the linked service was truncated, corrupted, or has extra whitespace from a manual copy-paste
3The linked service references the read-only key but the data flow requires a read-write key for write operations

How to fix it

1Open the Azure portal and go to your Cosmos DB account → Keys.
2Copy the full Primary key (or Secondary key as a fallback) — ensure no trailing spaces or line breaks are included.
3Open the Cosmos DB linked service in ADF Studio, update the account key field with the copied value, and click 'Test connection' to verify.
4If the pipeline performs write operations, confirm you are using a read-write key (not the read-only key shown in a separate section on the Keys page).

Frequently asked questions

How do I avoid this problem when rotating Cosmos DB keys?

Use the secondary key in ADF while rotating the primary key: update ADF to the secondary key, rotate the primary, then update ADF back to the new primary. This two-step rotation avoids downtime.

Can I use managed identity instead of account keys to avoid rotation issues?

Yes — switch the Cosmos DB linked service to Azure AD (managed identity or service principal). This eliminates key rotation as a failure vector.

Is the read-only key sufficient for data flow sources?

For read-only source operations, the read-only key works. For sink operations (upsert, delete, insert), use the read-write key.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/data-flow-troubleshoot-guide