My cosmosDB network settings are stuck on Updating since a week. Means we cannot update from public to IP-limited access.

Hi @Simon Grund Sørensen

If your Cosmos DB account’s Networking settings are stuck on “Updating” and you’re trying to switch from Public access to Selected networks or IP-based access, here’s what you can do:

Check what’s holding it up

First, confirm the account’s current state. Use the Azure CLI to see if the provisioning state is still “Updating” and whether there are pending private endpoints or firewall rules:

az cosmosdb show -g <resourceGroup> -n <accountName> --query "properties.provisioningState"

If it’s been stuck for more than an hour, something is blocking the update.

Common blockers to clear

• Pending Private Endpoint approvals: Go to Networking → Private endpoints in the portal and make sure none are stuck in “Pending.” Approve or reject them.
• Resource Locks: Check for any locks on the resource group or account and remove them.
• Provider registration: Re-register the Cosmos DB resource provider:
• Portal access toggle: Temporarily enable “Allow access from Azure portal” under Networking to help the update complete.

Apply changes in small steps

Instead of making multiple changes at once, update the settings in two steps using CLI:

Example: set IP rule: ---

az cosmosdb update -g <resourceGroup> -n <accountName> \

--set publicNetworkAccess=Enabled \

--ip-range-filter "203.0.113.10,198.51.100.0/24"

 Then enable VNet filter if needed

az cosmosdb update -g <resourceGroup> -n <accountName> \

--set isVirtualNetworkFilterEnabled=true

For MongoDB vCore clusters, use az resource update with the correct API version.

Ref: -
https://learn.microsoft.com/en-us/azure/documentdb/how-to-scale-cluster?tabs=portal
https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall#configure-an-ip-access-control-policy-by-using-the-azure-cli
https://learn.microsoft.com/en-us/azure/cosmos-db/security
https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/cosmosdb-private-endpoint/

From the CLI I can see the error is on deleting the Norway East redundant copy:
{

  "documentEndpoint": "https://mentimove-db-norwayeast.documents.azure.com:443/",

  "failoverPriority": 1,

  "id": "mentimove-db-norwayeast",

  "isZoneRedundant": false,

  "locationName": "Norway East",

  "provisioningState": "DeletionFailed"

}  

... I tried solving directly in the CLI:

az cosmosdb update \

-g <ressourceGroup> \

-n <accountName> \

--locations regionName="Sweden Central" failoverPriority=0 isZoneRedundant=false

But the CLI gets timeout before anything happens.

What more can I do from my part? I would like to repeat the wish to be set up with a technician as I believe this is an error too deep in the system for me to fix on our end.

Hi Simon Grund Sørensen,

Thank you for your patience. Based on the details you have shared we have identified that the Norway East region removal process did not complete successfully and is stuck in a DeletionFailed state. Unfortunately, this prevents any other updates, such as switching to IP-based access from completing successfully.

When this happens the control plane operations are blocked which is why attempts to update the networking settings or make changes via the portal or CLI are timing out. This issue requires backend intervention to clear the failed region.

I tried reaching out to you on Teams, but it seems you were unavailable. I'm sharing the update here, and to assist further, I need some specific details. Since these contain sensitive information, please share them with me in a private message