Azure DocumentDB read-write access to specific databases

We were excited to see the announcement of Azure DocumentDB at the recent Azure Ignite.

Currently we are doing a small POC and we were able to successfully connected our Spring Boot application to the cluster using Microsoft Entra ID authentication. However, when trying to achieve database-level isolation (using both native DocumentDB users and Microsoft Entra ID identities), we encountered issues, even though the documentation clearly states this should be possible:

“Nonadministrative users typically hold restricted roles, such as read-only or read-write access to specific databases, but lack the ability to perform cluster-wide administrative actions.”

Further down, the documentation provides an example of registering a principal as a readWrite user on the sales database.

https://learn.microsoft.com/en-us/azure/documentdb/how-to-connect-role-based-access-control?pivots=rest-api#enable-microsoft-entra-id-authentication

However, when we attempt this via Azure CLI:

C:\Users\john.doe> az resource create --resource-group "rg-johndoe-sbx" --name "mongojohndoe/users/<some-id>" --resource-type "Microsoft.DocumentDB/mongoClusters/users" --location "germanywestcentral" --properties "{"identityProvider":{"type":"MicrosoftEntraID","properties":{"principalType":"User"}},"roles":[{"db":"customers","role":"readWrite"}]}" --latest-include-preview

(bad_request) Provided database for role assignment is not valid (allowed: 'admin', provided: 'customers').

We also tried creating a secondary native user with the administrative native user via mongosh:

[mongos] customers> db.createUser({

   user: "admin.customers", pwd: "secret",

   roles: [{ role: "readWrite", db: "customers" }]

})

MongoServerError[RoleNotFound]: The specified value for the role is invalid: 'readWrite'.

For comparison, we tested the same scenario on a MongoDB instance running in Docker, and there we were able to achieve this isolation successfully using db.createUser() with readWrite on the target database.

Although the documentation clearly states that database-level RBAC should be possible, our attempts to implement it have failed. Could you please clarify:

Is database-level RBAC fully supported in the current preview for Azure DocumentDB? Is this a known limitation of the preview or a potential bug or are we just doing something wrong?