What it is
An Azure Cosmos DB account replicated to more than one region, with enableAutomaticFailover set to false. The data is in two places and the bill reflects it, but if the write region goes down, Cosmos DB will not promote the secondary on its own — someone has to notice the outage and initiate a manual failover. The expensive half of geo-redundancy is there; the automatic half was never switched on.
Why it happens
Adding a read region and enabling service-managed failover are two separate decisions. The portal makes adding a region satisfyingly easy, and the replication starts working immediately — reads are served, the redundancy line item appears on the bill, and everything looks done. Automatic failover is a different toggle (portal name: Service-Managed Failover; ARM property: enableAutomaticFailover), and nothing forces you past it.
Because the account behaves perfectly in every test and every normal day, the gap is invisible until the exact moment it matters: a regional outage, when write requests start failing and the runbook says "fail over manually" — assuming there is a runbook, the person on call has the right permissions, and they know this account is one of the manual ones.
This applies to single-write-region accounts (the common case). Accounts configured for multi-region writes handle regional loss differently and don't rely on this toggle.
What it costs / blast radius
No extra spend — this is a configuration gap on capacity you already pay for. The blast radius is availability: during a write-region outage, every write fails until a human notices, confirms it's a real regional event, and triggers the failover, typically under incident pressure at whatever hour Azure chose. Service-managed failover exists precisely to remove that human from the critical path; with it off, your effective recovery time is your on-call response time, not Cosmos DB's. (Authored assessment of Azure behavior, not a measured statistic.)
See it
resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2024-08-15' = {
name: 'cosmos-prod'
location: 'eastus2'
properties: {
databaseAccountOfferType: 'Standard'
enableAutomaticFailover: false // outage = manual failover
locations: [
{ locationName: 'eastus2', failoverPriority: 0 }
{ locationName: 'centralus', failoverPriority: 1 }
]
}
}resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2024-08-15' = {
name: 'cosmos-prod'
location: 'eastus2'
properties: {
databaseAccountOfferType: 'Standard'
enableAutomaticFailover: true // portal: Service-Managed Failover
locations: [
{ locationName: 'eastus2', failoverPriority: 0 }
{ locationName: 'centralus', failoverPriority: 1 } // promoted automatically
]
}
}How StratoLens helps
StratoLens flags every multi-region Cosmos DB account that still has automatic failover disabled — automatically, continuously, across every subscription in your tenant. Single-region accounts aren't flagged; there's nothing to fail over to. You find the gap in a report, not in an incident retro.