Grab a spot →
Skip to main content

How Atlan connects to Microsoft Azure Cosmos DB for NoSQL

Connect docs via MCP

Atlan connects to your Microsoft Azure Cosmos DB for NoSQL accounts to extract technical metadata while maintaining network security and compliance. Atlan supports two connection methods: direct connectivity from Atlan Cloud, and Self-Deployed Runtime running inside your own network.

In both methods, Atlan authenticates with a Microsoft Entra ID service principal and discovers every Cosmos DB for NoSQL account that principal is allowed to see. All traffic to Azure is outbound HTTPS over port 443.

Connect directly​

In direct connectivity, Atlan Cloud reaches your Cosmos DB accounts over the public Azure endpoint.

If your accounts restrict public network access to selected networks, you must allow Atlan's IP range before Atlan can connect.

Connect via self-deployed runtime​

If you don't want to open your accounts to Atlan Cloud, a runtime service deployed within your own network acts as a secure bridge. The runtime reaches Azure from inside your network perimeter, and your credentials never leave it.

  • The runtime maintains an outbound HTTPS connection to Atlan Cloud (port 443) and an outbound HTTPS connection to Azure (port 443).
  • Because the runtime connects from inside your network, you add the runtime's egress address to your Cosmos DB account network rules rather than Atlan's IP range.

For details on how Self-Deployed Runtime works, see SDR connectivity.

Security​

Atlan extracts structural metadata—accounts, databases, containers, the fields inferred from a sample of items, and the definitions of stored procedures, triggers, and user-defined functions. For example, if you have an orders container, Atlan discovers the container and its inferred field schema, but never catalogs the order records themselves.

  • Read-only operations: Every request Atlan makes is read-only. The connector can't create, modify, or delete accounts, databases, containers, items, or scripts. The Azure role you assign to the service principal controls exactly what the connector can reach.

  • Least-privilege access: The connector needs only read access to account metadata. See Set up Microsoft Azure Cosmos DB for NoSQL for the role to assign.

  • Credential handling: In direct connectivity, Atlan stores the service principal credentials encrypted and uses them only to request access tokens from Microsoft Entra ID. In Self-Deployed Runtime, the credentials stay in your own secret store and Atlan Cloud never receives them.

  • Scoped crawls: Atlan discovers every account the service principal can access. Use the include and exclude filters when you crawl to narrow a crawl to specific accounts and databases, or restrict the service principal's role assignments so it can only see the accounts you intend to catalog.

See also​