≈1.6k tokens on demand. Your agent reads this file only when SKILL.md points to it.
Data (Analytics) Pairing Constraints
Cosmos DB
| Paired With |
Constraint |
| Multi-region writes |
consistencyPolicy.defaultConsistencyLevel cannot be Strong when enableMultipleWriteLocations: true. |
| Strong consistency |
Strong consistency with regions >5000 miles apart is blocked by default (requires support ticket to enable). Strong and Bounded Staleness reads cost 2× RU/s compared to Session/Consistent Prefix/Eventual. |
| Serverless |
Cannot combine EnableServerless capability with multi-region writes or analytical store. Serverless is single-region only — cannot add regions. No shared throughput databases. Cannot provision throughput (auto-managed; settings return error). Merge partitions not available for serverless accounts. |
| Free tier |
Only one free-tier account per subscription. Cannot combine with multi-region writes. |
| VNet |
Set isVirtualNetworkFilterEnabled: true and configure virtualNetworkRules[] with subnet IDs. Subnets need Microsoft.AzureCosmosDB service endpoint. |
| Private Endpoint |
Set publicNetworkAccess: 'Disabled' when using private endpoints exclusively. One Private DNS Zone record per DNS name — multiple private endpoints in different regions need separate Private DNS Zones. |
| Key Vault (CMK) |
Requires keyVaultKeyUri in encryption config. Key Vault must be in same region. |
| Merge Partitions |
Not available for serverless or multi-region write accounts. Single-region provisioned throughput only. |
Redis Cache
| Paired With |
Constraint |
| VNet |
Only Premium SKU supports VNet injection via subnetId. Basic/Standard use firewall rules only. |
| VNet + Private Endpoint |
VNet injection and private endpoint are mutually exclusive — cannot use both on the same cache. |
| Private Endpoint |
Available for Basic, Standard, Premium, and Enterprise tiers. Set publicNetworkAccess: 'Disabled' when using private endpoints. Premium with clustering supports max 1 private link; non-clustered supports up to 100. |
| Clustering |
Only Premium SKU supports shardCount. Basic and Standard are single-node/two-node only. |
| Persistence |
Only Premium SKU supports RDB/AOF persistence. Requires a storage account for RDB exports. |
| Geo-replication |
Only Premium SKU. Primary and secondary must be Premium with same shard count. Passive geo-replication with private endpoints requires unlinking geo-replication first, adding private link, then re-linking. |
| Zones |
Zone redundancy requires Premium SKU with multiple replicas. |
| Tier Scaling |
Cannot scale down tiers (Enterprise → lower, Premium → Standard/Basic, Standard → Basic). Cannot scale between Enterprise and Enterprise Flash, or from Basic/Standard/Premium to Enterprise/Flash — must create a new cache. |
| Enterprise/Flash |
Firewall rules and publicNetworkAccess flag are not available on Enterprise/Enterprise Flash tiers. |
| Azure Lighthouse |
Azure Lighthouse + VNet injection is not supported. Use private links instead. |
Storage Account
| Paired With |
Constraint |
| Azure Functions |
Must use StorageV2 or Storage kind. BlobStorage, BlockBlobStorage, FileStorage not supported (missing Queue/Table). |
| Functions (Consumption plan) |
Cannot use network-secured storage (VNet rules). Only Premium/Dedicated plans support VNet-restricted storage. |
| Functions (zone-redundant) |
Must use ZRS SKU (Standard_ZRS). LRS/GRS not sufficient. |
| VM Boot Diagnostics |
Cannot use Premium storage or ZRS. Use Standard_LRS or Standard_GRS. Managed boot diagnostics (no storage account required) is also available. |
| CMK Encryption |
Key Vault must have enableSoftDelete: true AND enablePurgeProtection: true. |
| CMK at creation |
Requires user-assigned managed identity (system-assigned only works for existing accounts). |
| Geo-redundant failover |
Certain features (SFTP, NFS 3.0, etc.) block GRS/GZRS failover. |
Data Factory
| Paired With |
Constraint |
| Storage Account |
Linked service requires Storage Blob Data Contributor role on the storage account for the ADF managed identity. For ADLS Gen2, also requires Storage Blob Data Reader at minimum. |
| Key Vault |
For CMK encryption, Key Vault must have enableSoftDelete: true and enablePurgeProtection: true. ADF managed identity needs Key Vault Crypto Service Encryption User role or equivalent access policy. |
| Managed VNet |
When managedVirtualNetworks is configured, all outbound connections must use managed private endpoints (factories/managedVirtualNetworks/managedPrivateEndpoints). |
| Private Endpoint |
When publicNetworkAccess: 'Disabled', must create private endpoint to dataFactory sub-resource for studio access and pipeline connectivity. |
| Purview |
Requires Microsoft Purview instance resource ID. ADF managed identity must have Data Curator role in Purview. |
| Integration Runtime |
Self-hosted IR requires network line-of-sight to on-premises sources. Azure IR regional choice affects data residency. |
Synapse Workspace
| Paired With |
Constraint |
| ADLS Gen2 Storage Account |
Required. Storage account must have isHnsEnabled: true (hierarchical namespace / Data Lake Storage Gen2) and kind: 'StorageV2'. Synapse managed identity needs Storage Blob Data Contributor role on the storage account. |
| Key Vault |
For CMK encryption, Key Vault must have enableSoftDelete: true and enablePurgeProtection: true. Synapse managed identity needs Get, Unwrap Key, and Wrap Key permissions. |
| Managed VNet |
When managedVirtualNetwork: 'default', all outbound connections require managed private endpoints. Set at creation time — cannot be changed after. |
| Private Endpoint |
When publicNetworkAccess: 'Disabled', create private endpoints for sub-resources: Dev (Studio), Sql (dedicated SQL), SqlOnDemand (serverless SQL). |
| Purview |
Requires Microsoft Purview resource ID. Synapse managed identity needs appropriate Purview roles. |
| VNet (compute subnet) |
virtualNetworkProfile.computeSubnetId must reference an existing subnet. The subnet must be delegated to Microsoft.Synapse/workspaces if required by the deployment model. |
