Create an Azure Cosmos account with virtual network service endpoints using Azure CLI

APPLIES TO: SQL API Cassandra API Gremlin API Table API Azure Cosmos DB API for MongoDB


  • Use the Bash environment in Azure Cloud Shell.

    Launch Cloud Shell in a new window

  • If you prefer, install the Azure CLI to run CLI reference commands.

    • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For additional sign-in options, see Sign in with the Azure CLI.

    • When you're prompted, install Azure CLI extensions on first use. For more information about extensions, see Use extensions with the Azure CLI.

    • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

  • This article requires version 2.9.1 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

Sample script

This sample creates a new virtual network with a front and back end subnet and enables service endpoints for Microsoft.AzureCosmosDB. It then retrieves the resource ID for this subnet and applies it to the Azure Cosmos account and enables service endpoints for the account.


This sample demonstrates using a Core (SQL) API account. To use this sample for other APIs, apply the enable-virtual-network and virtual-network-rules parameters in the script below to your API specific script.

# Reference: az cosmosdb |
# --------------------------------------------------
# Service endpoint operations for an Azure Cosmos account
# Create an Azure Cosmos Account with a service endpoint connected to a backend subnet

# Resource group and Cosmos account variables
accountName="cosmos-$uniqueId" #needs to be lower case

# Variables for a new Virtual Network with two subnets

# Create a resource group
az group create -n $resourceGroupName -l $location

# Create a virtual network with a front-end subnet
az network vnet create \
    -n $vnetName \
    -g $resourceGroupName \
    --address-prefix \
    --subnet-name $frontEnd \

# Create a back-end subnet
az network vnet subnet create \
    -n $backEnd \
    -g $resourceGroupName \
    --address-prefix \
    --vnet-name $vnetName \
    --service-endpoints Microsoft.AzureCosmosDB

svcEndpoint=$(az network vnet subnet show -g $resourceGroupName -n $backEnd --vnet-name $vnetName --query 'id' -o tsv)

# Create a Cosmos DB account with default values and service endpoints
# Use appropriate values for --kind or --capabilities for other APIs
az cosmosdb create \
    -n $accountName \
    -g $resourceGroupName \
    --enable-virtual-network true \
    --virtual-network-rules $svcEndpoint

Clean up deployment

After the script sample has been run, the following command can be used to remove the resource group and all resources associated with it.

az group delete --name $resourceGroupName

Script explanation

This script uses the following commands. Each command in the table links to command specific documentation.

Command Notes
az group create Creates a resource group in which all resources are stored.
az network vnet create Creates an Azure virtual network.
az network vnet subnet create Creates a subnet for an Azure virtual network.
az network vnet subnet show Returns a subnet for an Azure virtual network.
az cosmosdb create Creates an Azure Cosmos DB account.
az group delete Deletes a resource group including all nested resources.

Next steps

For more information on the Azure Cosmos DB CLI, see Azure Cosmos DB CLI documentation.

All Azure Cosmos DB CLI script samples can be found in the Azure Cosmos DB CLI GitHub Repository.