microsoft/graphrag · error · ValueError

Specify either 'connection_string' or 'account_url', not bot

Error message

Specify either 'connection_string' or 'account_url', not both.

What it means

AzureCosmosStorage accepts two mutually exclusive ways to reach CosmosDB: a full connection string or an account URL paired with DefaultAzureCredential. Supplying both is ambiguous (which auth wins?), so the constructor rejects it immediately. This is a guard against conflicting authentication configuration.

Source

Thrown at packages/graphrag-storage/graphrag_storage/azure_cosmos_storage.py:71

    def __init__(
        self,
        database_name: str,
        container_name: str,
        connection_string: str | None = None,
        account_url: str | None = None,
        encoding: str = "utf-8",
        namespace: str = "",
        **kwargs: Any,
    ) -> None:
        """Create a CosmosDB key-value storage instance."""
        logger.info("Creating CosmosDB key-value storage")
        if not database_name:
            msg = "CosmosDB Storage requires 'database_name'."
            raise ValueError(msg)

        if connection_string is not None and account_url is not None:
            msg = "Specify either 'connection_string' or 'account_url', not both."
            raise ValueError(msg)

        if connection_string:
            self._cosmos_client = CosmosClient.from_connection_string(connection_string)
        elif account_url:
            self._cosmos_client = CosmosClient(
                url=account_url,
                credential=DefaultAzureCredential(),
            )
        else:
            msg = "CosmosDB Storage requires 'connection_string' or 'account_url'."
            raise ValueError(msg)

        self._encoding = encoding
        self._database_name = database_name
        self._connection_string = connection_string
        self._cosmosdb_account_url = account_url
        self._container_name = container_name
        self._namespace = namespace

View on GitHub (pinned to f40e9a26ce)

Solutions

1. Pick one auth method: keep connection_string and remove account_url, or vice versa
2. If the connection string comes from an env var, unset it when using account_url + DefaultAzureCredential
3. Prefer account_url with managed identity for production deployments

Example fix

# before
AzureCosmosStorage(connection_string=conn, account_url="https://myacct.documents.azure.com")
# after
AzureCosmosStorage(account_url="https://myacct.documents.azure.com")  # uses DefaultAzureCredential

assert not (cfg.get("connection_string") and cfg.get("account_url")), "pick one cosmos auth method"

When it happens

Trigger: Passing both connection_string and account_url to AzureCosmosStorage.__init__, e.g. having GRAPHRAG_COSMOSDB_CONNECTION_STRING set while also setting account_url in config.

Common situations: Env-var connection string leaks into a config that also specifies account_url for managed-identity auth; merging example configs that each use a different auth style.

Related errors

• Specify either 'connection_string' or 'account_url', not bot
• api_key should not be set when using Azure Managed Identity.
• api_key must be set when auth_method=api_key.
• AzureBlobStorage requires only one of connection_string or a
• AzureBlobStorage requires either a connection_string or acco

AI-assisted analysis of microsoft/graphrag@f40e9a26ce (2026-08-27). Data as JSON: /api/errors/ec6a8201c2e6df72. Report an issue: GitHub.