microsoft/graphrag · error · ValueError

Specify either 'connection_string' or 'account_url', not bot

Error message

Specify either 'connection_string' or 'account_url', not both.

What it means

CosmosTableProvider supports exactly one authentication route — connection string or account URL with AAD credentials. Providing both is rejected at construction to avoid ambiguity about which credential source governs the connection.

Source

Thrown at packages/graphrag-storage/graphrag_storage/tables/cosmos_table_provider.py:97

        if _container is not None:
            # Fast path: child() or test injection.
            self._cosmos_client = _cosmos_client
            self._container = _container
            self._legacy_container = _legacy_container
            self._namespace = namespace
            self._owns_client = False
            return

        # Normal construction from config values.
        if not database_name:
            msg = "CosmosTableProvider requires 'database_name'."
            raise ValueError(msg)
        if not container_name:
            msg = "CosmosTableProvider requires 'container_name'."
            raise ValueError(msg)
        if connection_string and account_url:
            msg = "Specify either 'connection_string' or 'account_url', not both."
            raise ValueError(msg)
        if not connection_string and not account_url:
            msg = "CosmosTableProvider requires 'connection_string' or 'account_url'."
            raise ValueError(msg)

        if connection_string:
            self._cosmos_client = CosmosClient.from_connection_string(connection_string)
        else:
            self._cosmos_client = CosmosClient(
                url=account_url,  # type: ignore[arg-type]
                credential=DefaultAzureCredential(),
            )

        self._namespace = namespace
        self._owns_client = True

        # Containers are created lazily on first use via _ensure_container().
        self._database_name = database_name
        self._container_name = container_name

View on GitHub (pinned to f40e9a26ce)

Solutions

  1. Remove one of the two credentials from config/env
  2. Unset the conflicting env var (e.g. GRAPHRAG_COSMOSDB_CONNECTION_STRING) if you intend account_url auth
  3. Prefer account_url + managed identity in production

Example fix

# before
connection_string: ${COSMOS_CONN}
url: https://myacct.documents.azure.com
# after
url: https://myacct.documents.azure.com
Defensive patterns

Strategy: validation

Validate before calling

assert not (cfg.get("connection_string") and cfg.get("url")), "one cosmos credential only"

Prevention

When it happens

Trigger: Passing both connection_string and account_url to CosmosTableProvider, most often because a connection-string env var is set while the YAML also declares account_url (or vice versa).

Common situations: Shared env vars from another cosmos component injecting a connection string; config merging two example files that use different auth styles.

Related errors

AI-assisted analysis of microsoft/graphrag@f40e9a26ce (2026-08-27). Data as JSON: /api/errors/4d854313431f8f3d. Report an issue: GitHub.