---
title: Copy and transform data in Azure Cosmos DB for NoSQL
titleSuffix: Azure Data Factory & Azure Synapse
description: Learn how to copy data to and from Azure Cosmos DB for NoSQL, and transform data in Azure Cosmos DB for NoSQL using Azure Data Factory and Azure Synapse Analytics.
ms.author: tinglee
author: simplywilson
ms.subservice: data-movement
ms.topic: concept-article
ms.date: 07/25/2025
ms.custom:
- synapse
- sfi-image-nochange
- sfi-ropc-nochange
---
# Copy and transform data in Azure Cosmos DB for NoSQL by using Azure Data Factory
[!INCLUDE[appliesto-adf-asa-md](includes/appliesto-adf-asa-md.md)]
This article outlines how to use Copy Activity in Azure Data Factory to copy data from and to Azure Cosmos DB for NoSQL, and use Data Flow to transform data in Azure Cosmos DB for NoSQL. To learn more, read the introductory articles for [Azure Data Factory](introduction.md) and [Azure Synapse Analytics](../synapse-analytics/overview-what-is.md).
> [!NOTE]
> This connector is also available in [Data Factory in Microsoft Fabric](/fabric/data-factory/data-factory-overview). For Fabric-specific configuration and features, see the [Fabric Azure Cosmos DB for NoSQL connector documentation](/fabric/data-factory/connector-azure-cosmosdb-for-nosql-overview).
>[!NOTE]
>This connector only supports Azure Cosmos DB for NoSQL. For Azure Cosmos DB for MongoDB, refer to [connector for Azure Cosmos DB for MongoDB](connector-azure-cosmos-db-mongodb-api.md). Other API types aren't supported now.
## Supported capabilities
This Azure Cosmos DB for NoSQL connector is supported for the following capabilities:
| Supported capabilities|IR | Managed private endpoint|
|---------| --------| --------|
|[Copy activity](copy-activity-overview.md) (source/sink)|① ②|✓ |
|[Mapping data flow](concepts-data-flow-overview.md) (source/sink)|① |✓ |
|[Lookup activity](control-flow-lookup-activity.md)|① ②|✓ |
*① Azure integration runtime ② Self-hosted integration runtime*
For Copy activity, this Azure Cosmos DB for NoSQL connector supports:
- Copy data from and to the [Azure Cosmos DB for NoSQL](/azure/cosmos-db/introduction) using key, service principal, or managed identities for Azure resources authentications.
- Write to Azure Cosmos DB as **insert** or **upsert**.
- Import and export JSON documents as-is, or copy data from or to a tabular dataset. Examples include a SQL database and a CSV file. To copy documents as-is to or from JSON files or to or from another Azure Cosmos DB collection, see [Import and export JSON documents](#import-and-export-json-documents).
Data Factory and Synapse pipelines integrate with the [Azure Cosmos DB bulk executor library](https://github.com/Azure/azure-cosmosdb-bulkexecutor-dotnet-getting-started) to provide the best performance when you write to Azure Cosmos DB.
> [!TIP]
> The [Data Migration video](https://youtu.be/5-SRNiC_qOU) walks you through the steps of copying data from Azure Blob storage to Azure Cosmos DB. The video also describes performance-tuning considerations for ingesting data to Azure Cosmos DB in general.
## Get started
[!INCLUDE [data-factory-v2-connector-get-started](includes/data-factory-v2-connector-get-started.md)]
## Create a linked service to Azure Cosmos DB using UI
Use the following steps to create a linked service to Azure Cosmos DB in the Azure portal UI.
1. Browse to the Manage tab in your Azure Data Factory or Synapse workspace and select Linked Services, then select New:
# [Azure Data Factory](#tab/data-factory)
:::image type="content" source="media/doc-common-process/new-linked-service.png" alt-text="Screenshot of creating a new linked service with Azure Data Factory UI.":::
# [Azure Synapse](#tab/synapse-analytics)
:::image type="content" source="media/doc-common-process/new-linked-service-synapse.png" alt-text="Screenshot of creating a new linked service with Azure Synapse UI.":::
2. Search for Azure Cosmos DB for NoSQL and select the Azure Cosmos DB for NoSQL connector.
:::image type="content" source="media/connector-azure-cosmos-db/azure-cosmos-db-connector.png" alt-text="Select Azure Cosmos DB for NoSQL connector.":::
1. Configure the service details, test the connection, and create the new linked service.
:::image type="content" source="media/connector-azure-cosmos-db/configure-azure-cosmos-db-linked-service.png" alt-text="Screenshot of linked service configuration for Azure Cosmos DB.":::
## Connector configuration details
The following sections provide details about properties you can use to define entities that are specific to Azure Cosmos DB for NoSQL.
## Linked service properties
The Azure Cosmos DB for NoSQL connector supports the following authentication types. See the corresponding sections for details:
- [Key authentication](#key-authentication)
- [Service principal authentication](#service-principal-authentication)
- [System-assigned managed identity authentication](#managed-identity)
- [User-assigned managed identity authentication](#user-assigned-managed-identity-authentication)
### Key authentication
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The **type** property must be set to **CosmosDb**. | Yes |
| connectionString |Specify information that's required to connect to the Azure Cosmos DB database. **Note**: You must specify database information in the connection string as shown in the examples that follow. You can also put account key in Azure Key Vault and pull the `accountKey` configuration out of the connection string. Refer to the following samples and [Store credentials in Azure Key Vault](store-credentials-in-key-vault.md) article with more details. |Yes |
| connectVia | The [Integration Runtime](concepts-integration-runtime.md) to use to connect to the data store. You can use the Azure Integration Runtime or a self-hosted integration runtime (if your data store is located in a private network). If this property isn't specified, the default Azure Integration Runtime is used. |No |
**Example**
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"connectionString": "AccountEndpoint=;AccountKey=;Database="
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
**Example: store account key in Azure Key Vault**
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"connectionString": "AccountEndpoint=;Database=",
"accountKey": {
"type": "AzureKeyVaultSecret",
"store": {
"referenceName": "",
"type": "LinkedServiceReference"
},
"secretName": ""
}
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
### Service principal authentication
>[!NOTE]
>Currently, the service principal authentication isn't supported in data flow.
To use service principal authentication, follow these steps.
1. Register an application with the Microsoft identity platform. To learn how, see [Quickstart: Register an application with the Microsoft identity platform](../active-directory/develop/quickstart-register-app.md). Make note of these values, which you use to define the linked service:
- Application ID
- Application key
- Tenant ID
2. Grant the service principal proper permission. See examples on how permission works in Azure Cosmos DB from [Access control lists on files and directories](/azure/cosmos-db/how-to-setup-rbac). More specifically, create a role definition, and assign the role to the service principal via service principal object ID.
These properties are supported for the linked service:
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The type property must be set to **CosmosDb**. |Yes |
| accountEndpoint | Specify the account endpoint URL for the Azure Cosmos DB instance. | Yes |
| database | Specify the name of the database. | Yes |
| servicePrincipalId | Specify the application's client ID. | Yes |
| servicePrincipalCredentialType | The credential type to use for service principal authentication. Allowed values are **ServicePrincipalKey** and **ServicePrincipalCert**. | Yes |
| servicePrincipalCredential | The service principal credential. When you use **ServicePrincipalKey** as the credential type, specify the application's key. Mark this field as **SecureString** to store it securely, or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). When you use **ServicePrincipalCert** as the credential, reference a certificate in Azure Key Vault, and ensure the certificate content type is **PKCS #12**.| Yes |
| tenant | Specify the tenant information (domain name or tenant ID) under which your application resides. Retrieve it by hovering the mouse in the upper-right corner of the Azure portal. | Yes |
| azureCloudType | For service principal authentication, specify the type of Azure cloud environment to which your Microsoft Entra application is registered. Allowed values are **AzurePublic**, **AzureChina**, **AzureUsGovernment**, and **AzureGermany**. By default, the service's cloud environment is used. | No |
| connectVia | The [integration runtime](concepts-integration-runtime.md) to be used to connect to the data store. You can use the Azure integration runtime or a self-hosted integration runtime if your data store is in a private network. If not specified, the default Azure integration runtime is used. |No |
**Example: using service principal key authentication**
You can also store service principal key in Azure Key Vault.
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"accountEndpoint": "",
"database": "",
"servicePrincipalId": "",
"servicePrincipalCredentialType": "ServicePrincipalKey",
"servicePrincipalCredential": {
"type": "SecureString",
"value": ""
},
"tenant": ""
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
**Example: using service principal certificate authentication**
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"accountEndpoint": "",
"database": "",
"servicePrincipalId": "",
"servicePrincipalCredentialType": "ServicePrincipalCert",
"servicePrincipalCredential": {
"type": "AzureKeyVaultSecret",
"store": {
"referenceName": "",
"type": "LinkedServiceReference"
},
"secretName": ""
},
"tenant": ""
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
### System-assigned managed identity authentication
>[!NOTE]
>Currently, the system-assigned managed identity authentication is supported in data flows by using advanced properties in JSON format.
A data factory or Synapse pipeline can be associated with a [system-assigned managed identity for Azure resources](data-factory-service-identity.md#system-assigned-managed-identity), which represents this specific service instance. You can directly use this managed identity for Azure Cosmos DB authentication, similar to using your own service principal. It allows this designated resource to access and copy data to or from your Azure Cosmos DB instance.
To use system-assigned managed identities for Azure resource authentication, follow these steps.
1. [Retrieve the system-assigned managed identity information](data-factory-service-identity.md#retrieve-managed-identity) by copying the value of the **managed identity object ID** generated along with your service.
2. Grant the system-assigned managed identity proper permission. See examples on how permission works in Azure Cosmos DB from [Access control lists on files and directories](/azure/cosmos-db/how-to-setup-rbac). More specifically, create a role definition, and assign the role to the system-assigned managed identity.
These properties are supported for the linked service:
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The type property must be set to **CosmosDb**. |Yes |
| accountEndpoint | Specify the account endpoint URL for the Azure Cosmos DB instance. | Yes |
| database | Specify the name of the database. | Yes |
| connectVia | The [integration runtime](concepts-integration-runtime.md) to be used to connect to the data store. You can use the Azure integration runtime or a self-hosted integration runtime if your data store is in a private network. If not specified, the default Azure integration runtime is used. |No |
| subscriptionId | Specify the subscription ID for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
| tenantId | Specify the tenant ID for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
| resourceGroup | Specify the resource group name for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
**Example:**
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"accountEndpoint": "",
"database": "",
"subscriptionId": "",
"tenantId": "",
"resourceGroup": ""
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
### User-assigned managed identity authentication
>[!NOTE]
>Currently, user-assigned managed identity authentication is supported in data flows by using advanced properties in JSON format.
A data factory or Synapse pipeline can be associated with a [user-assigned managed identities](data-factory-service-identity.md#user-assigned-managed-identity), which represents this specific service instance. You can directly use this managed identity for Azure Cosmos DB authentication, similar to using your own service principal. It allows this designated resource to access and copy data to or from your Azure Cosmos DB instance.
To use user-assigned managed identities for Azure resource authentication, follow these steps.
1. [Create one or multiple user-assigned managed identities](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md) and grant the user-assigned managed identity proper permission. See examples on how permission works in Azure Cosmos DB from [Access control lists on files and directories](/azure/cosmos-db/how-to-setup-rbac). More specifically, create a role definition, and assign the role to the user-assigned managed identity.
2. Assign one or multiple user-assigned managed identities to your data factory and [create credentials](credentials.md) for each user-assigned managed identity.
These properties are supported for the linked service:
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The type property must be set to **CosmosDb**. |Yes |
| accountEndpoint | Specify the account endpoint URL for the Azure Cosmos DB instance. | Yes |
| database | Specify the name of the database. | Yes |
| credentials | Specify the user-assigned managed identity as the credential object. | Yes |
| connectVia | The [integration runtime](concepts-integration-runtime.md) to be used to connect to the data store. You can use the Azure integration runtime or a self-hosted integration runtime if your data store is in a private network. If not specified, the default Azure integration runtime is used. |No |
| subscriptionId | Specify the subscription ID for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
| tenantId | Specify the tenant ID for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
| resourceGroup | Specify the resource group name for the Azure Cosmos DB instance | No for Copy Activity, Yes for Mapping Data Flow |
**Example:**
```json
{
"name": "CosmosDbSQLAPILinkedService",
"properties": {
"type": "CosmosDb",
"typeProperties": {
"accountEndpoint": "",
"database": "",
"credential": {
"referenceName": "credential1",
"type": "CredentialReference"
},
"subscriptionId": "",
"tenantId": "",
"resourceGroup": ""
},
"connectVia": {
"referenceName": "",
"type": "IntegrationRuntimeReference"
}
}
}
```
## Dataset properties
For a full list of sections and properties that are available for defining datasets, see [Datasets and linked services](concepts-datasets-linked-services.md).
The following properties are supported for Azure Cosmos DB for NoSQL dataset:
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The **type** property of the dataset must be set to **CosmosDbSqlApiCollection**. |Yes |
| collectionName |The name of the Azure Cosmos DB document collection. |Yes |
If you use "DocumentDbCollection" type dataset, it's still supported as-is for backward compatibility for Copy and Lookup activity, it's not supported for Data Flow. You're suggested to use the new model going forward.
**Example**
```json
{
"name": "CosmosDbSQLAPIDataset",
"properties": {
"type": "CosmosDbSqlApiCollection",
"linkedServiceName":{
"referenceName": "",
"type": "LinkedServiceReference"
},
"schema": [],
"typeProperties": {
"collectionName": ""
}
}
}
```
## Copy Activity properties
This section provides a list of properties that the Azure Cosmos DB for NoSQL source and sink support. For a full list of sections and properties that are available for defining activities, see [Pipelines](concepts-pipelines-activities.md).
### Azure Cosmos DB for NoSQL as source
To copy data from Azure Cosmos DB for NoSQL, set the **source** type in Copy Activity to **DocumentDbCollectionSource**.
The following properties are supported in the Copy Activity **source** section:
| Property | Description | Required |
|:--- |:--- |:--- |
| type | The **type** property of the copy activity source must be set to **CosmosDbSqlApiSource**. |Yes |
| query |Specify the Azure Cosmos DB query to read data.
Example: `SELECT c.BusinessEntityID, c.Name.First AS FirstName, c.Name.Middle AS MiddleName, c.Name.Last AS LastName, c.Suffix, c.EmailPromotion FROM c WHERE c.ModifiedDate > \"2009-01-01T00:00:00\"` |No
If not specified, this SQL statement is executed: `select from mycollection` |
| preferredRegions | The preferred list of regions to connect to when retrieving data from Azure Cosmos DB. | No |
| pageSize | The number of documents per page of the query result. Default is "-1" which means uses the service side dynamic page size up to 1000. | No |
| detectDatetime | Whether to detect datetime from the string values in the documents. Allowed values are: **true** (default), **false**. | No |
If you use "DocumentDbCollectionSource" type source, it's still supported as-is for backward compatibility. You're suggested to use the new model going forward, which provides richer capabilities to copy data from Azure Cosmos DB.
**Example**
```json
"activities":[
{
"name": "CopyFromCosmosDBSQLAPI",
"type": "Copy",
"inputs": [
{
"referenceName": "",
"type": "DatasetReference"
}
],
"outputs": [
{
"referenceName": "