From e55e734b1e145af9bbf1a90bfed31c21efd788e3 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 13:53:52 -0400
Subject: [PATCH 1/7] [cosmos] Namespace live-test databases to the run that
 owns them

The Cosmos live tests are moving off per-run provisioned accounts and onto
fixed, self-owned accounts that are shared with other language SDKs and with
concurrent runs of this suite. Databases are the only account-scoped namespace
the tests control, so every database created against a live account now carries
a prefix identifying the run that created it.

Adds RESOURCE_PREFIX / RUN_ID / unique_database_id() to test_config.py. The run
id combines Build.BuildId with a random suffix: the build id groups every matrix
leg of a single pipeline run, which is what an out-of-band cleanup pass matches
on, while the suffix keeps parallel legs distinct.

Two call sites embed the generated id rather than using it verbatim so their
assertions still mean something: test_crud_database keeps a literal leading
space for the "id can begin with space" case, and test_resource_id keeps its
unicode and special-character payload.

Also fixes a latent bug in the create_database_if_not_exists negative tests,
which used a hardcoded "responses_test" id. Both calls now share one run-scoped
id, so the second call is guaranteed to be the one exercising the already-exists
path; previously a leftover database from any earlier run made the first call
take that path too, and the test silently stopped testing what it claimed.

Left alone deliberately: create_database_if_not_exists("test", ...) in
test_crud*.py runs through TimeoutTransport with passthrough disabled and never
reaches the service, test_proxy's database is emulator-only, and the
id_with_illegal* cases are negative tests where creation is expected to fail.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 .../azure-cosmos/tests/test_auto_scale.py     |  6 ++--
 .../tests/test_auto_scale_async.py            |  6 ++--
 .../tests/test_backwards_compatibility.py     |  8 ++---
 .../test_backwards_compatibility_async.py     |  8 ++---
 sdk/cosmos/azure-cosmos/tests/test_config.py  | 35 ++++++++++++++++++-
 .../tests/test_cosmos_http_logging_policy.py  | 10 +++---
 .../test_cosmos_http_logging_policy_async.py  | 10 +++---
 .../tests/test_cosmos_responses.py            | 18 ++++++----
 .../tests/test_cosmos_responses_async.py      | 18 ++++++----
 .../azure-cosmos/tests/test_crud_database.py  | 11 +++---
 .../tests/test_crud_database_async.py         |  9 +++--
 ...crud_response_payload_on_write_disabled.py | 10 +++---
 ...esponse_payload_on_write_disabled_async.py |  8 ++---
 .../tests/test_full_text_policy.py            |  2 +-
 .../tests/test_full_text_policy_async.py      |  2 +-
 .../tests/test_global_secondary_index_live.py |  2 +-
 .../tests/test_query_hybrid_search.py         |  2 +-
 .../tests/test_query_hybrid_search_async.py   |  2 +-
 .../tests/test_query_vector_similarity.py     |  2 +-
 .../test_query_vector_similarity_async.py     |  2 +-
 .../azure-cosmos/tests/test_resource_id.py    | 10 +++---
 .../tests/test_resource_id_async.py           | 10 +++---
 .../tests/test_streaming_failover.py          |  2 +-
 sdk/cosmos/azure-cosmos/tests/test_utils.py   |  3 +-
 .../azure-cosmos/tests/test_vector_policy.py  |  2 +-
 .../tests/test_vector_policy_async.py         |  2 +-
 26 files changed, 121 insertions(+), 79 deletions(-)

diff --git a/sdk/cosmos/azure-cosmos/tests/test_auto_scale.py b/sdk/cosmos/azure-cosmos/tests/test_auto_scale.py
index 634dd8c6b52b..4699372ca8b3 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_auto_scale.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_auto_scale.py
@@ -72,7 +72,7 @@ def test_autoscale_create_container(self):
             self.created_database.delete_container(container_id)
 
     def test_autoscale_create_database(self):
-        database_id = "db_auto_scale_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("auto-scale")
         try:
             # Testing auto_scale_settings for the create_database method
             created_database = self.key_client.create_database(database_id, offer_throughput=ThroughputProperties(
@@ -87,7 +87,7 @@ def test_autoscale_create_database(self):
             self.key_client.delete_database(created_database.id)
 
             # Testing auto_scale_settings for the create_database_if_not_exists method
-            database_id = "db_auto_scale_2_" + str(uuid.uuid4())
+            database_id = test_config.unique_database_id("auto-scale-2")
             created_database = self.key_client.create_database_if_not_exists(database_id,
                                                                          offer_throughput=ThroughputProperties(
                                                                              auto_scale_max_throughput=9000,
@@ -101,7 +101,7 @@ def test_autoscale_create_database(self):
             self.key_client.delete_database(database_id)
 
     def test_autoscale_replace_throughput(self):
-        database_id = "replace_db" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("replace-db")
         container_id = None
         try:
             created_database = self.key_client.create_database(database_id, offer_throughput=ThroughputProperties(
diff --git a/sdk/cosmos/azure-cosmos/tests/test_auto_scale_async.py b/sdk/cosmos/azure-cosmos/tests/test_auto_scale_async.py
index 7fa9c36f6163..43b0c26fb658 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_auto_scale_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_auto_scale_async.py
@@ -82,7 +82,7 @@ async def test_autoscale_create_database_async(self):
         database_id = None
         try:
             # Testing auto_scale_settings for the create_database method
-            database_id = "db1_" + str(uuid.uuid4())
+            database_id = test_config.unique_database_id("db1")
             created_database = await self.key_client.create_database(database_id, offer_throughput=ThroughputProperties(
                 auto_scale_max_throughput=5000,
                 auto_scale_increment_percent=0))
@@ -95,7 +95,7 @@ async def test_autoscale_create_database_async(self):
             await self.key_client.delete_database(created_database.id)
 
             # Testing auto_scale_settings for the create_database_if_not_exists method
-            database_id = "db2_" + str(uuid.uuid4())
+            database_id = test_config.unique_database_id("db2")
             created_database = await self.key_client.create_database_if_not_exists(database_id, offer_throughput=ThroughputProperties(
                 auto_scale_max_throughput=9000,
                 auto_scale_increment_percent=11))
@@ -108,7 +108,7 @@ async def test_autoscale_create_database_async(self):
             await self.key_client.delete_database(database_id)
 
     async def test_replace_throughput_async(self):
-        database_id = "replace_db" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("replace-db")
         container_id = None
         try:
             created_database = await self.key_client.create_database(database_id, offer_throughput=ThroughputProperties(
diff --git a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
index 4f4b2e9a1bfe..19a664d40505 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
@@ -64,9 +64,9 @@ def test_populate_partition_key_range_statistics(self):
     def test_session_token_compatibility(self):
         # Verifying that behavior is unaffected across the board for using `session_token` on irrelevant methods
         # Database
-        database = self.client.create_database(str(uuid.uuid4()), session_token=str(uuid.uuid4()))
+        database = self.client.create_database(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database is not None
-        database2 = self.client.create_database_if_not_exists(str(uuid.uuid4()), session_token=str(uuid.uuid4()))
+        database2 = self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database2 is not None
         database_list = list(self.client.list_databases(session_token=str(uuid.uuid4())))
         database_list2 = list(self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4())))
@@ -109,9 +109,9 @@ def test_session_token_compatibility(self):
     def test_etag_match_condition_compatibility(self):
         # Verifying that behavior is unaffected across the board for using `etag`/`match_condition` on irrelevant methods
         # Database
-        database = self.client.create_database(str(uuid.uuid4()), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
+        database = self.client.create_database(test_config.unique_database_id("backcompat"), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
         assert database is not None
-        database2 = self.client.create_database_if_not_exists(str(uuid.uuid4()), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfNotModified)
+        database2 = self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfNotModified)
         assert database2 is not None
         self.client.delete_database(database2.id, etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
         try:
diff --git a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
index d9dcfd988cec..bcd391be9e0d 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
@@ -47,9 +47,9 @@ async def asyncTearDown(self):
     async def test_session_token_compatibility_async(self):
         # Verifying that behavior is unaffected across the board for using `session_token` on irrelevant methods
         # Database
-        database = await self.client.create_database(str(uuid.uuid4()), session_token=str(uuid.uuid4()))
+        database = await self.client.create_database(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database is not None
-        database2 = await self.client.create_database_if_not_exists(str(uuid.uuid4()), session_token=str(uuid.uuid4()))
+        database2 = await self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database2 is not None
         database_list = [db async for db in self.client.list_databases(session_token=str(uuid.uuid4()))]
         database_list2 = [db async for db in self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4()))]
@@ -93,9 +93,9 @@ async def test_session_token_compatibility_async(self):
     async def test_etag_match_condition_compatibility_async(self):
         # Verifying that behavior is unaffected across the board for using `etag`/`match_condition` on irrelevant methods
         # Database
-        database = await self.client.create_database(str(uuid.uuid4()), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
+        database = await self.client.create_database(test_config.unique_database_id("backcompat"), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
         assert database is not None
-        database2 = await self.client.create_database_if_not_exists(str(uuid.uuid4()), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfNotModified)
+        database2 = await self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), etag=str(uuid.uuid4()), match_condition=MatchConditions.IfNotModified)
         assert database2 is not None
         await self.client.delete_database(database2.id, etag=str(uuid.uuid4()), match_condition=MatchConditions.IfModified)
         try:
diff --git a/sdk/cosmos/azure-cosmos/tests/test_config.py b/sdk/cosmos/azure-cosmos/tests/test_config.py
index 5b5e9fd061e5..a75d6120a33e 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_config.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_config.py
@@ -36,6 +36,39 @@
 SPLIT_TIMEOUT = 60*10  # timeout test at 10 minutes
 SLEEP_TIME = 30  # sleep for 30 seconds
 
+# The live tests run against fixed, long-lived accounts that are shared with other
+# language SDKs and with concurrent runs of this suite. Databases are the only
+# account-scoped namespace we control, so every database this suite creates carries a
+# prefix identifying the run that owns it. That keeps concurrent runs from colliding and
+# lets cleanup delete only what a given run created.
+RESOURCE_PREFIX = "PythonSDKTest"
+
+
+def _build_run_id():
+    # Build.BuildId is shared by every matrix leg of one pipeline run, which is what an
+    # out-of-band janitor matches on; the random suffix keeps parallel legs distinct.
+    build_id = os.getenv('BUILD_BUILDID')
+    suffix = uuid.uuid4().hex[:8]
+    return "{}-{}".format(build_id, suffix) if build_id else suffix
+
+
+RUN_ID = _build_run_id()
+
+
+def unique_database_id(label=""):
+    """Build a database id owned by this test run.
+
+    Format: ``PythonSDKTest-<run id>-<label>-<random>``. Callers that need particular
+    characters in the id (unicode, leading spaces) can embed this in a larger id; only
+    the prefix is required for ownership.
+    """
+    parts = [RESOURCE_PREFIX, RUN_ID]
+    if label:
+        parts.append(label)
+    parts.append(uuid.uuid4().hex)
+    return "-".join(parts)
+
+
 class TestConfig(object):
     local_host = 'https://localhost:8081/'
     # [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Cosmos DB Emulator Key")]
@@ -175,7 +208,7 @@ def create_test_clients_async(cls, database_id, **kwargs):
     THROUGHPUT_FOR_2_PARTITIONS = 12000
     THROUGHPUT_FOR_1_PARTITION = 400
 
-    TEST_DATABASE_ID = os.getenv('COSMOS_TEST_DATABASE_ID', "PythonSDKTestDatabase-" + str(uuid.uuid4()))
+    TEST_DATABASE_ID = os.getenv('COSMOS_TEST_DATABASE_ID', unique_database_id("Shared"))
 
     TEST_SINGLE_PARTITION_CONTAINER_ID = "SinglePartitionTestContainer-" + str(uuid.uuid4())
     TEST_MULTI_PARTITION_CONTAINER_ID = "MultiPartitionTestContainer-" + str(uuid.uuid4())
diff --git a/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy.py b/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy.py
index bbd9089d23a7..0dce8779b36c 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy.py
@@ -123,7 +123,7 @@ def setUpClass(cls):
 
     def test_default_http_logging_policy(self):
         # Test if we can log into from creating a database
-        database_id = "database_test-" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         self.client_default.create_database(id=database_id)
         assert all(m.levelname == 'INFO' for m in self.mock_handler_default.messages)
         messages_request = self.mock_handler_default.messages[0].message.split("\n")
@@ -141,7 +141,7 @@ def test_default_http_logging_policy(self):
 
     def test_cosmos_http_logging_policy(self):
         # Test if we can log info from reading a database
-        database_id = "database_test-" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         self.client_diagnostic.create_database(id=database_id)
         assert all(m.levelname == 'INFO' for m in self.mock_handler_diagnostic.messages)
         # Check that we made a databaseaccount read request only once and that we only logged it once
@@ -193,7 +193,7 @@ def test_cosmos_http_logging_policy(self):
 
     def test_filtered_diagnostics_logging_policy(self):
         # Test if we can log errors with the filtered diagnostics logger
-        database_id = "database_test_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         container_id = "diagnostics_container_test_" + str(uuid.uuid4())
         self.client_filtered_diagnostic.create_database(id=database_id)
         database = self.client_filtered_diagnostic.get_database_client(database_id)
@@ -313,7 +313,7 @@ def test_activity_id_logging_policy(self):
         custom_activity_id = str(uuid.uuid4())
 
         # Create a database and container for the test
-        database_id = "database_test_activity_id_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging-activity-id")
         container_id = "container_test_activity_id_" + str(uuid.uuid4())
         database = self.client_activity_id.create_database(id=database_id)
         container = database.create_container(id=container_id, partition_key=PartitionKey(path="/pk"))
@@ -396,7 +396,7 @@ def test_hierarchical_logger_with_filter(self):
         self.root_mock_handler.reset()
 
         # Attempt to read a nonexistent item
-        database_id = "database_test_hierarchical_logger_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging-hierarchical")
         container_id = "container_test_hierarchical_logger_" + str(uuid.uuid4())
         database = self.client_grandchild_logger.create_database(id=database_id)
         container = database.create_container(id=container_id, partition_key=PartitionKey(path="/pk"))
diff --git a/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy_async.py b/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy_async.py
index d607e940420c..134162b940f5 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_cosmos_http_logging_policy_async.py
@@ -80,7 +80,7 @@ async def test_default_http_logging_policy_async(self):
                                                          consistency_level="Session", logger=self.logger)
         await self.client_default.__aenter__()
         # Test if we can log info from creating a database
-        database_id = "database_test-" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         await self.client_default.create_database(id=database_id)
 
         assert all(m.levelname == 'INFO' for m in self.mock_handler_default.messages)
@@ -108,7 +108,7 @@ async def test_cosmos_http_logging_policy_async(self):
         # give time to background health check to run
         await asyncio.sleep(1)
         # Test if we can log into from reading a database
-        database_id = "database_test-" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         await self.client_diagnostic.create_database(id=database_id)
         assert all(m.levelname == 'INFO' for m in self.mock_handler_diagnostic.messages)
         # Check that we made a databaseaccount read request only once and that we only logged it once
@@ -167,7 +167,7 @@ async def test_filtered_diagnostics_logging_policy_async(self):
                                                                      logger=self.logger,
                                                                      enable_diagnostics_logging=True)
         # Test if we can log errors with the filtered diagnostics logger
-        database_id = "database_test_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging")
         container_id = "diagnostics_container_test_" + str(uuid.uuid4())
         await self.client_filtered_diagnostic.create_database(id=database_id)
         database = self.client_filtered_diagnostic.get_database_client(database_id)
@@ -283,7 +283,7 @@ async def test_activity_id_logging_policy_async(self):
         custom_activity_id = str(uuid.uuid4())
 
         # Create a database and container for the test
-        database_id = "database_test_activity_id_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging-activity-id")
         container_id = "container_test_activity_id_" + str(uuid.uuid4())
         try:
 
@@ -389,7 +389,7 @@ async def test_hierarchical_logger_with_filter_async(self):
         root_mock_handler.reset()
 
         # Attempt to read a nonexistent item
-        database_id = "database_test_hierarchical_logger_" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("logging-hierarchical")
         container_id = "container_test_hierarchical_logger_" + str(uuid.uuid4())
         database = await self.client_grandchild_logger.create_database(id=database_id)
         container = await database.create_container(id=container_id, partition_key=PartitionKey(path="/pk"))
diff --git a/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses.py b/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses.py
index 21787c181f7d..25c4920f13ec 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses.py
@@ -82,21 +82,25 @@ def test_point_operation_headers(self):
         assert int(lsn) + 1 < int(batch_response.get_response_headers()['lsn'])
 
     def test_create_database_headers(self):
-        first_response = self.client.create_database(id="responses_test" + str(uuid.uuid4()), return_properties=True)
+        first_response = self.client.create_database(id=test_config.unique_database_id("responses"), return_properties=True)
 
         assert len(first_response[1].get_response_headers()) > 0
 
     def test_create_database_returns_database_proxy(self):
-        first_response = self.client.create_database(id="responses_test" + str(uuid.uuid4()))
+        first_response = self.client.create_database(id=test_config.unique_database_id("responses"))
         assert isinstance(first_response, DatabaseProxy)
 
     def test_create_database_if_not_exists_headers(self):
-        first_response = self.client.create_database_if_not_exists(id="responses_test" + str(uuid.uuid4()), return_properties=True)
+        first_response = self.client.create_database_if_not_exists(id=test_config.unique_database_id("responses"), return_properties=True)
         assert len(first_response[1].get_response_headers()) > 0
 
     def test_create_database_if_not_exists_headers_negative(self):
-        first_response = self.client.create_database_if_not_exists(id="responses_test", return_properties=True)
-        second_response = self.client.create_database_if_not_exists(id="responses_test", return_properties=True)
+        # Both calls must target the same id so the second one exercises the
+        # already-exists path; the id is run-scoped so a leftover database from another
+        # run can't make the first call take that path too.
+        database_id = test_config.unique_database_id("responses-negative")
+        first_response = self.client.create_database_if_not_exists(id=database_id, return_properties=True)
+        second_response = self.client.create_database_if_not_exists(id=database_id, return_properties=True)
         assert len(second_response[1].get_response_headers()) > 0
 
     def test_create_container_headers(self):
@@ -129,7 +133,7 @@ def test_replace_container_headers(self):
         assert len(second_response[1].get_response_headers()) > 0
 
     def test_database_read_headers(self):
-        db = self.client.create_database(id="responses_test" + str(uuid.uuid4()))
+        db = self.client.create_database(id=test_config.unique_database_id("responses"))
         first_response = db.read()
         assert len(first_response.get_response_headers()) > 0
 
@@ -148,7 +152,7 @@ def test_container_replace_throughput(self):
         assert replace_throughput_value == container.get_throughput().offer_throughput
 
     def test_database_replace_throughput(self):
-        db = self.client.create_database(id="responses_test" + str(uuid.uuid4()), offer_throughput=400)
+        db = self.client.create_database(id=test_config.unique_database_id("responses"), offer_throughput=400)
         replace_throughput_value = 500
         first_response = db.replace_throughput(replace_throughput_value)
         assert len(first_response.get_response_headers()) > 0
diff --git a/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses_async.py b/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses_async.py
index 7ee500903466..4933735b03e7 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_cosmos_responses_async.py
@@ -85,21 +85,25 @@ async def test_point_operation_headers_async(self):
         assert int(lsn) + 1 < int(batch_response.get_response_headers()['lsn'])
 
     async def test_create_database_headers_async(self):
-        first_response = await self.client.create_database(id="responses_test" + str(uuid.uuid4()), return_properties=True)
+        first_response = await self.client.create_database(id=test_config.unique_database_id("responses"), return_properties=True)
 
         assert len(first_response[1].get_response_headers()) > 0
 
     async def test_create_database_returns_database_proxy_async(self):
-        first_response = await self.client.create_database(id="responses_test" + str(uuid.uuid4()))
+        first_response = await self.client.create_database(id=test_config.unique_database_id("responses"))
         assert isinstance(first_response, DatabaseProxy)
 
     async def test_create_database_if_not_exists_headers_async(self):
-        first_response = await self.client.create_database_if_not_exists(id="responses_test" + str(uuid.uuid4()), return_properties=True)
+        first_response = await self.client.create_database_if_not_exists(id=test_config.unique_database_id("responses"), return_properties=True)
         assert len(first_response[1].get_response_headers()) > 0
 
     async def test_create_database_if_not_exists_headers_negative_async(self):
-        first_response = await self.client.create_database_if_not_exists(id="responses_test", return_properties=True)
-        second_response = await self.client.create_database_if_not_exists(id="responses_test", return_properties=True)
+        # Both calls must target the same id so the second one exercises the
+        # already-exists path; the id is run-scoped so a leftover database from another
+        # run can't make the first call take that path too.
+        database_id = test_config.unique_database_id("responses-negative")
+        first_response = await self.client.create_database_if_not_exists(id=database_id, return_properties=True)
+        second_response = await self.client.create_database_if_not_exists(id=database_id, return_properties=True)
         assert len(second_response[1].get_response_headers()) > 0
 
     async def test_create_container_headers_async(self):
@@ -132,7 +136,7 @@ async def test_replace_container_headers_async(self):
         assert len(second_response[1].get_response_headers()) > 0
 
     async def test_database_read_headers_async(self):
-        db = await self.client.create_database(id="responses_test" + str(uuid.uuid4()))
+        db = await self.client.create_database(id=test_config.unique_database_id("responses"))
         first_response = await db.read()
         assert len(first_response.get_response_headers()) > 0
 
@@ -152,7 +156,7 @@ async def test_container_replace_throughput_async(self):
         assert replace_throughput_value == new_throughput.offer_throughput
 
     async def test_database_replace_throughput_async(self):
-        db = await self.client.create_database(id="responses_test" + str(uuid.uuid4()), offer_throughput=400)
+        db = await self.client.create_database(id=test_config.unique_database_id("responses"), offer_throughput=400)
         replace_throughput_value = 500
         first_response = await db.replace_throughput(replace_throughput_value)
         assert len(first_response.get_response_headers()) > 0
diff --git a/sdk/cosmos/azure-cosmos/tests/test_crud_database.py b/sdk/cosmos/azure-cosmos/tests/test_crud_database.py
index ab2c60b56bd2..f4bc170d8ec2 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_crud_database.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_crud_database.py
@@ -10,7 +10,6 @@
 import time
 import unittest
 import urllib.parse as urllib
-import uuid
 
 import pytest
 import requests
@@ -90,7 +89,7 @@ def tearDownClass(cls):
             cls.key_client.close()
 
     def test_database_crud(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = self.key_client.create_database(database_id)
         self.assertEqual(created_db.id, database_id)
         # Read databases after creation.
@@ -125,7 +124,7 @@ def test_database_crud(self):
     def test_database_level_offer_throughput(self):
         # Create a database with throughput
         offer_throughput = 1000
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = self.key_client.create_database(
             id=database_id,
             offer_throughput=offer_throughput
@@ -144,8 +143,8 @@ def test_database_level_offer_throughput(self):
 
     def test_sql_query_crud(self):
         # create two databases.
-        db1 = self.key_client.create_database('database 1' + str(uuid.uuid4()))
-        db2 = self.key_client.create_database('database 2' + str(uuid.uuid4()))
+        db1 = self.key_client.create_database(test_config.unique_database_id("db1"))
+        db2 = self.key_client.create_database(test_config.unique_database_id("db2"))
 
         # query with parameters.
         databases = list(self.key_client.query_databases({
@@ -224,7 +223,7 @@ def test_id_validation(self):
             self.assertEqual('Id contains illegal chars.', e.args[0])
 
         # Id can begin with space
-        db = self.key_client.create_database(id=' id_begin_space' + str(uuid.uuid4()))
+        db = self.key_client.create_database(id=' ' + test_config.unique_database_id("id-begin-space"))
         self.assertTrue(True)
 
         self.key_client.delete_database(db.id)
diff --git a/sdk/cosmos/azure-cosmos/tests/test_crud_database_async.py b/sdk/cosmos/azure-cosmos/tests/test_crud_database_async.py
index 120266e7c4da..19739f2026b5 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_crud_database_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_crud_database_async.py
@@ -10,7 +10,6 @@
 import time
 import unittest
 import urllib.parse as urllib
-import uuid
 
 import pytest
 import requests
@@ -96,7 +95,7 @@ async def asyncTearDown(self):
         await self.client.close()
 
     async def test_database_crud_async(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = await self.key_client.create_database(database_id)
         assert created_db.id == database_id
         # query databases.
@@ -135,7 +134,7 @@ async def test_database_crud_async(self):
     async def test_database_level_offer_throughput_async(self):
         # Create a database with throughput
         offer_throughput = 1000
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = await self.key_client.create_database(
             id=database_id,
             offer_throughput=offer_throughput
@@ -155,8 +154,8 @@ async def test_database_level_offer_throughput_async(self):
 
     async def test_sql_query_crud_async(self):
         # create two databases.
-        db1 = await self.key_client.create_database('database 1' + str(uuid.uuid4()))
-        db2 = await self.key_client.create_database('database 2' + str(uuid.uuid4()))
+        db1 = await self.key_client.create_database(test_config.unique_database_id("db1"))
+        db2 = await self.key_client.create_database(test_config.unique_database_id("db2"))
 
         # query with parameters.
         databases = [database async for database in self.key_client.query_databases(
diff --git a/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled.py b/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled.py
index cc414cd63c7c..e5335e2e3fd7 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled.py
@@ -151,7 +151,7 @@ def tearDown(self):
         self.last_headers.clear()
 
     def test_database_crud(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = self.key_client.create_database(database_id)
         self.assertEqual(created_db.id, database_id)
         # Read databases after creation.
@@ -186,7 +186,7 @@ def test_database_crud(self):
     def test_database_level_offer_throughput(self):
         # Create a database with throughput
         offer_throughput = 1000
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = self.key_client.create_database(
             id=database_id,
             offer_throughput=offer_throughput
@@ -205,8 +205,8 @@ def test_database_level_offer_throughput(self):
 
     def test_sql_query_crud(self):
         # create two databases.
-        db1 = self.key_client.create_database('database 1' + str(uuid.uuid4()))
-        db2 = self.key_client.create_database('database 2' + str(uuid.uuid4()))
+        db1 = self.key_client.create_database(test_config.unique_database_id("db1"))
+        db2 = self.key_client.create_database(test_config.unique_database_id("db2"))
 
         # query with parameters.
         databases = list(self.key_client.query_databases({
@@ -2506,7 +2506,7 @@ def test_id_validation(self):
             self.assertEqual('Id contains illegal chars.', e.args[0])
 
         # Id can begin with space
-        db = self.key_client.create_database(id=' id_begin_space' + str(uuid.uuid4()))
+        db = self.key_client.create_database(id=' ' + test_config.unique_database_id("id-begin-space"))
         self.assertTrue(True)
 
         self.key_client.delete_database(db.id)
diff --git a/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled_async.py b/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled_async.py
index f7636df1b41e..cbe006df4bcc 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_crud_response_payload_on_write_disabled_async.py
@@ -143,7 +143,7 @@ async def asyncTearDown(self):
         await self.key_client.close()
 
     async def test_database_crud_async(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = await self.key_client.create_database(database_id)
         assert created_db.id == database_id
         # query databases.
@@ -182,7 +182,7 @@ async def test_database_crud_async(self):
     async def test_database_level_offer_throughput_async(self):
         # Create a database with throughput
         offer_throughput = 1000
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         created_db = await self.key_client.create_database(
             id=database_id,
             offer_throughput=offer_throughput
@@ -202,8 +202,8 @@ async def test_database_level_offer_throughput_async(self):
 
     async def test_sql_query_crud_async(self):
         # create two databases.
-        db1 = await self.key_client.create_database('database 1' + str(uuid.uuid4()))
-        db2 = await self.key_client.create_database('database 2' + str(uuid.uuid4()))
+        db1 = await self.key_client.create_database(test_config.unique_database_id("db1"))
+        db2 = await self.key_client.create_database(test_config.unique_database_id("db2"))
 
         # query with parameters.
         databases = [database async for database in self.key_client.query_databases(
diff --git a/sdk/cosmos/azure-cosmos/tests/test_full_text_policy.py b/sdk/cosmos/azure-cosmos/tests/test_full_text_policy.py
index bcc86b911e46..7f5f0269e870 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_full_text_policy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_full_text_policy.py
@@ -69,7 +69,7 @@ def setUpClass(cls):
         # calls through cls.data_client.get_database_client(...).get_container_client(...).
         cls.data_client = test_config.TestConfig.create_data_client()
         cls.created_database = cls.client.get_database_client(test_config.TestConfig.TEST_DATABASE_ID)
-        cls.test_db = cls.client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.client.create_database(test_config.unique_database_id("full-text"))
 
     @classmethod
     def tearDownClass(cls):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_full_text_policy_async.py b/sdk/cosmos/azure-cosmos/tests/test_full_text_policy_async.py
index 751397a11324..e8d3224f3ccd 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_full_text_policy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_full_text_policy_async.py
@@ -64,7 +64,7 @@ def setUpClass(cls):
                 "'masterKey' and 'host' at the top of this class to run the "
                 "tests.")
         cls.cosmos_sync_client = CosmosSyncClient(cls.host, cls.masterKey)
-        cls.test_db = cls.cosmos_sync_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.cosmos_sync_client.create_database(test_config.unique_database_id("full-text"))
 
     @classmethod
     def tearDownClass(cls):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_global_secondary_index_live.py b/sdk/cosmos/azure-cosmos/tests/test_global_secondary_index_live.py
index 36a82f768fcc..d8750b51d2a9 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_global_secondary_index_live.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_global_secondary_index_live.py
@@ -34,7 +34,7 @@ def setUpClass(cls):
                 "'masterKey' and 'host' at the top of this class to run the "
                 "tests.")
         cls.client = CosmosClient(cls.host, cls.masterKey)
-        cls.test_db = cls.client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.client.create_database(test_config.unique_database_id("gsi"))
 
     @classmethod
     def tearDownClass(cls):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search.py b/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search.py
index ba45c6930dc3..12c708008680 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search.py
@@ -42,7 +42,7 @@ def setUpClass(cls):
         # DB + container create + item seeding go through key-auth setup client
         # (control-plane). Tests query through the AAD data client below.
         cls.key_client = cosmos_client.CosmosClient(cls.host, cls.masterKey)
-        cls.test_db = cls.key_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.key_client.create_database(test_config.unique_database_id("hybrid-search"))
         key_container = cls.test_db.create_container(
             id=cls.TEST_CONTAINER_ID,
             partition_key=PartitionKey(path="/pk"),
diff --git a/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search_async.py b/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search_async.py
index b5f7307d8357..25fbcc0b6020 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_query_hybrid_search_async.py
@@ -37,7 +37,7 @@ def setUpClass(cls):
                 "'masterKey' and 'host' at the top of this class to run the "
                 "tests.")
         cls.sync_client = CosmosSyncClient(cls.host, cls.masterKey)
-        cls.test_db = cls.sync_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.sync_client.create_database(test_config.unique_database_id("hybrid-search"))
         cls.test_container = cls.test_db.create_container(
             id=cls.TEST_CONTAINER_ID,
             partition_key=PartitionKey(path="/pk"),
diff --git a/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity.py b/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity.py
index 1ae5451a70b0..8564841832b0 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity.py
@@ -49,7 +49,7 @@ def setUpClass(cls):
 
         # control-plane (create_database / create_container / seeding / delete) on key-auth.
         cls.key_client = cosmos_client.CosmosClient(cls.host, cls.masterKey)
-        cls.test_db = cls.key_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.key_client.create_database(test_config.unique_database_id("vector-similarity"))
         cls.created_quantized_cosine_container = cls.test_db.create_container(
             id="quantized" + cls.TEST_CONTAINER_ID,
             partition_key=PartitionKey(path="/pk"),
diff --git a/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity_async.py b/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity_async.py
index d0be16306ae4..a932564cea2e 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_query_vector_similarity_async.py
@@ -47,7 +47,7 @@ def setUpClass(cls):
                 "'masterKey' and 'host' at the top of this class to run the "
                 "tests.")
         cls.sync_client = CosmosSyncClient(cls.host, cls.masterKey)
-        cls.test_db = cls.sync_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.sync_client.create_database(test_config.unique_database_id("vector-similarity"))
         cls.created_quantized_cosine_container = cls.test_db.create_container(
             id="quantized" + cls.TEST_CONTAINER_ID,
             partition_key=PartitionKey(path="/pk"),
diff --git a/sdk/cosmos/azure-cosmos/tests/test_resource_id.py b/sdk/cosmos/azure-cosmos/tests/test_resource_id.py
index 3dda1071141e..904835057fe2 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_resource_id.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_resource_id.py
@@ -33,18 +33,20 @@ def setUpClass(cls):
         cls.client = test_config.TestConfig.create_data_client()
 
     def test_id_unicode_validation(self):
+        # Ids are prefixed so the databases are attributable to this run; the unicode and
+        # special-character content this test exercises is preserved verbatim after it.
         # unicode chars in Hindi for Id which translates to: "Hindi is the national language of India"
-        resource_id1 = (
+        resource_id1 = test_config.unique_database_id("unicode") + (
             u'\u0939\u093f\u0928\u094d\u0926\u0940 '
             u'\u092d\u093e\u0930\u0924 '
             u'\u0915\u0940 '
             u'\u0930\u093e\u0937\u094d\u091f\u094d\u0930\u0940\u092f '
             u'\u092d\u093e\u0937\u093e '
             u'\u0939\u0948'
-        ) + str(uuid.uuid4())
+        )
 
         # Special allowed chars for Id
-        resource_id2 = "!@$%^&*()-~`'_[]{}|;:,.<>" + str(uuid.uuid4())
+        resource_id2 = test_config.unique_database_id("special-chars") + "!@$%^&*()-~`'_[]{}|;:,.<>"
 
         # verify that databases are created with specified IDs
         created_db1 = self.key_client.create_database_if_not_exists(resource_id1)
@@ -78,7 +80,7 @@ def test_id_unicode_validation(self):
         self.key_client.delete_database(resource_id2)
 
     def test_create_illegal_characters(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         container_id = str(uuid.uuid4())
         partition_key = PartitionKey(path="/id")
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_resource_id_async.py b/sdk/cosmos/azure-cosmos/tests/test_resource_id_async.py
index 747be9a490b3..d4b6b91c4feb 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_resource_id_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_resource_id_async.py
@@ -43,18 +43,20 @@ async def asyncTearDown(self):
         await self.key_client.close()
 
     async def test_id_unicode_validation_async(self):
+        # Ids are prefixed so the databases are attributable to this run; the unicode and
+        # special-character content this test exercises is preserved verbatim after it.
         # unicode chars in Hindi for Id which translates to: "Hindi is the national language of India"
-        resource_id1 = (
+        resource_id1 = test_config.unique_database_id("unicode") + (
             u'\u0939\u093f\u0928\u094d\u0926\u0940 '
             u'\u092d\u093e\u0930\u0924 '
             u'\u0915\u0940 '
             u'\u0930\u093e\u0937\u094d\u091f\u094d\u0930\u0940\u092f '
             u'\u092d\u093e\u0937\u093e '
             u'\u0939\u0948'
-        ) + str(uuid.uuid4())
+        )
 
         # Special allowed chars for Id
-        resource_id2 = "!@$%^&*()-~`'_[]{}|;:,.<>" + str(uuid.uuid4())
+        resource_id2 = test_config.unique_database_id("special-chars") + "!@$%^&*()-~`'_[]{}|;:,.<>"
 
         # verify that databases are created with specified IDs (control-plane -> key_client)
         created_db1 = await self.key_client.create_database_if_not_exists(resource_id1)
@@ -90,7 +92,7 @@ async def test_id_unicode_validation_async(self):
         await self.key_client.delete_database(resource_id2)
 
     async def test_create_illegal_characters_async(self):
-        database_id = str(uuid.uuid4())
+        database_id = test_config.unique_database_id()
         container_id = str(uuid.uuid4())
         partition_key = PartitionKey(path="/id")
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_streaming_failover.py b/sdk/cosmos/azure-cosmos/tests/test_streaming_failover.py
index bb2a986e6471..1de0110c2ea5 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_streaming_failover.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_streaming_failover.py
@@ -56,7 +56,7 @@ def test_streaming_fail_over(self):
             self.mock_get_read_endpoints)
         client.client_connection._global_endpoint_manager.location_cache.get_write_regional_routing_contexts = (
             self.mock_get_write_endpoints)
-        created_db = client.create_database_if_not_exists("streaming-db" + str(uuid.uuid4()))
+        created_db = client.create_database_if_not_exists(test_config.unique_database_id("streaming"))
         created_container = created_db.create_container("streaming-container" + str(uuid.uuid4()),
                                                         PartitionKey(path="/id"))
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_utils.py b/sdk/cosmos/azure-cosmos/tests/test_utils.py
index fae6d6b763f8..aeb14af9b9b7 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_utils.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_utils.py
@@ -3,7 +3,6 @@
 
 import platform
 import unittest
-import uuid
 
 import pytest
 
@@ -33,7 +32,7 @@ def test_connection_string(self):
         client: CosmosClient = (azure.cosmos.CosmosClient
                                 .from_connection_string(test_config.TestConfig.connection_str,
                                                         consistency_level="Session"))
-        database_id = "connection_string_test" + str(uuid.uuid4())
+        database_id = test_config.unique_database_id("connection-string")
         db = client.create_database(database_id)
         self.assertTrue(db is not None)
         client.delete_database(db.id)
diff --git a/sdk/cosmos/azure-cosmos/tests/test_vector_policy.py b/sdk/cosmos/azure-cosmos/tests/test_vector_policy.py
index 523ef78c6aeb..23af3df2bcf3 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_vector_policy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_vector_policy.py
@@ -111,7 +111,7 @@ def setUpClass(cls):
         # against a populated container), route those through cls.data_client.
         cls.data_client = test_config.TestConfig.create_data_client()
         cls.created_database = cls.client.get_database_client(test_config.TestConfig.TEST_DATABASE_ID)
-        cls.test_db = cls.client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.client.create_database(test_config.unique_database_id("vector-policy"))
 
     @classmethod
     def tearDownClass(cls):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_vector_policy_async.py b/sdk/cosmos/azure-cosmos/tests/test_vector_policy_async.py
index 9abe74151147..bcf50d25e73f 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_vector_policy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_vector_policy_async.py
@@ -36,7 +36,7 @@ def setUpClass(cls):
                 "'masterKey' and 'host' at the top of this class to run the "
                 "tests.")
         cls.cosmos_sync_client = CosmosSyncClient(cls.host, cls.masterKey)
-        cls.test_db = cls.cosmos_sync_client.create_database(str(uuid.uuid4()))
+        cls.test_db = cls.cosmos_sync_client.create_database(test_config.unique_database_id("vector-policy"))
 
     @classmethod
     def tearDownClass(cls):

From 36fd686748bef91fb3a37275fece8ed762731a36 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:22:25 -0400
Subject: [PATCH 2/7] [cosmos] Restore process state tests mutate, and register
 cosmosSearchQuery

Live tests toggle SDK feature flags through os.environ, but every one of them
"restored" the flag by writing an assumed default rather than the value it
replaced. On the circuit-breaker matrix legs the pipeline sets
AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER=True for the whole job
(test-resources.bicep:107), so test_availability_strategy deleting the variable
and test_user_agent setting it to "False" silently disabled the feature under
test for every test that ran later in the same process.

Add test_config.set_environment_variables / restore_environment_variables, which
capture prior values and put them back exactly -- including removing variables
that were previously unset -- and route the toggles through them. Sites that
mutate before entering their try block now register the restore with
addCleanup so it runs even if setup fails.

Also fixes leaks that had no restore at all:
- test_aad{,_async}.test_account_scope_only and test_account_scope_fallback_on_error
  set AZURE_COSMOS_AAD_SCOPE_OVERRIDE="" and never cleared it, so the leak was
  order-dependent on the two tests that did clear it.
- test_session_token_unit.validate_different_session_token_false_progress_merge_scenarios
  set AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE and never cleared it.

Separately, register the cosmosSearchQuery marker in pytest.ini. It is used by
8 test files and selected by the macos311_search_query matrix leg but was never
declared.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 sdk/cosmos/azure-cosmos/pytest.ini            |  1 +
 sdk/cosmos/azure-cosmos/tests/test_aad.py     | 18 ++++++-------
 .../azure-cosmos/tests/test_aad_async.py      | 14 ++++++-----
 .../tests/test_availability_strategy.py       | 12 ++++-----
 .../tests/test_availability_strategy_async.py | 12 ++++-----
 .../tests/test_circuit_breaker_emulator.py    | 16 ++++++------
 .../test_circuit_breaker_emulator_async.py    | 16 ++++++------
 sdk/cosmos/azure-cosmos/tests/test_config.py  | 25 +++++++++++++++++++
 .../test_per_partition_circuit_breaker_mm.py  |  8 +++---
 ..._per_partition_circuit_breaker_mm_async.py |  8 +++---
 ...st_per_partition_circuit_breaker_sm_mrr.py |  4 +--
 ..._partition_circuit_breaker_sm_mrr_async.py |  4 +--
 .../azure-cosmos/tests/test_retry_policy.py   | 13 +++++-----
 .../tests/test_retry_policy_async.py          | 13 +++++-----
 .../tests/test_session_token_unit.py          | 12 +++++----
 .../azure-cosmos/tests/test_user_agent.py     |  4 +--
 .../tests/test_user_agent_async.py            |  4 +--
 17 files changed, 110 insertions(+), 74 deletions(-)

diff --git a/sdk/cosmos/azure-cosmos/pytest.ini b/sdk/cosmos/azure-cosmos/pytest.ini
index e7facc2e9ca7..e3154a718b6a 100644
--- a/sdk/cosmos/azure-cosmos/pytest.ini
+++ b/sdk/cosmos/azure-cosmos/pytest.ini
@@ -8,6 +8,7 @@ markers =
     cosmosEmulator: marks tests as depending in Cosmos DB Emulator.
     cosmosLong: marks tests to be run on a Cosmos DB live account.
     cosmosQuery: marks tests running queries on Cosmos DB live account.
+    cosmosSearchQuery: marks tests running full text and vector search queries on a Cosmos DB live account.
     cosmosAADLong: marks AAD tests for the standard live-account lane.
     cosmosAADSplit: marks AAD tests for partition split scenarios.
     cosmosAADMultiRegion: marks AAD tests for multi-region scenarios.
diff --git a/sdk/cosmos/azure-cosmos/tests/test_aad.py b/sdk/cosmos/azure-cosmos/tests/test_aad.py
index 437ad59aa519..fbea0b3c5105 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_aad.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_aad.py
@@ -138,7 +138,8 @@ def capturing_get_token(self, *scopes, **kwargs):
     def test_override_scope_no_fallback(self):
         """When override scope is provided, only that scope is used and no fallback occurs."""
         override_scope = "https://my.custom.scope/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = override_scope
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE=override_scope)
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         def action(scopes_captured):
             credential = CosmosEmulatorCredential()
@@ -152,7 +153,6 @@ def action(scopes_captured):
         try:
             assert all(scope == override_scope for scope in scopes), f"Expected only override scope(s), got: {scopes}"
         finally:
-            del os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"]
             try:
                 container.delete_item(item='Item_10', partition_key='pk')
             except Exception:
@@ -162,7 +162,8 @@ def action(scopes_captured):
     def test_override_scope_auth_error_no_fallback(self):
         """When override scope is provided and auth fails, no fallback to other scopes occurs."""
         override_scope = "https://my.custom.scope/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = override_scope
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE=override_scope)
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         class FailingCredential(CosmosEmulatorCredential):
             def get_token(self, *scopes, **kwargs):
@@ -178,16 +179,14 @@ def action(scopes_captured):
             return None
 
         scopes, _ = self._run_with_scope_capture(FailingCredential, action)
-        try:
-            assert scopes == [override_scope], f"Expected only override scope, got: {scopes}"
-        finally:
-            del os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"]
+        assert scopes == [override_scope], f"Expected only override scope, got: {scopes}"
 
     @_skip_on_non_emulator
     def test_account_scope_only(self):
         """When account scope is provided, only that scope is used."""
         account_scope = "https://localhost/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = ""
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE="")
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         def action(scopes_captured):
             credential = CosmosEmulatorCredential()
@@ -212,7 +211,8 @@ def test_account_scope_fallback_on_error(self):
         """When account scope is provided and auth fails, fallback to default scope occurs."""
         account_scope = "https://localhost/.default"
         fallback_scope = "https://cosmos.azure.com/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = ""
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE="")
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         class FallbackCredential(CosmosEmulatorCredential):
             def __init__(self):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_aad_async.py b/sdk/cosmos/azure-cosmos/tests/test_aad_async.py
index 20fec64a666b..c3c2959c2e88 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_aad_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_aad_async.py
@@ -139,7 +139,8 @@ async def capturing_get_token(self, *scopes, **kwargs):
     async def test_override_scope_no_fallback_async(self):
         """When override scope is provided, only that scope is used and no fallback occurs."""
         override_scope = "https://my.custom.scope/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = override_scope
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE=override_scope)
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         async def action(scopes_captured):
             credential = CosmosEmulatorCredential()
@@ -156,7 +157,6 @@ async def action(scopes_captured):
         try:
             assert all(scope == override_scope for scope in scopes), f"Expected only override scope, got: {scopes}"
         finally:
-            del os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"]
             try:
                 await container.delete_item(item='Item_20', partition_key='pk')
             except Exception:
@@ -166,7 +166,8 @@ async def action(scopes_captured):
     async def test_override_scope_no_fallback_on_error_async(self):
         """When override scope is provided and auth fails, no fallback occurs."""
         override_scope = "https://my.custom.scope/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = override_scope
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE=override_scope)
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         class FailingCredential(CosmosEmulatorCredential):
             async def get_token(self, *scopes, **kwargs):
@@ -190,7 +191,6 @@ async def action(scopes_captured):
         try:
             assert all(scope == override_scope for scope in scopes), f"Expected only override scope, got: {scopes}"
         finally:
-            del os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"]
             try:
                 await container.delete_item(item='Item_21', partition_key='pk')
             except Exception:
@@ -200,7 +200,8 @@ async def action(scopes_captured):
     async def test_account_scope_only_async(self):
         """When account scope is provided, only that scope is used."""
         account_scope = "https://localhost/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = ""
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE="")
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         async def action(scopes_captured):
             credential = CosmosEmulatorCredential()
@@ -227,7 +228,8 @@ async def test_account_scope_fallback_on_error_async(self):
         """When account scope is provided and auth fails, fallback to default scope occurs."""
         account_scope = "https://localhost/.default"
         fallback_scope = "https://cosmos.azure.com/.default"
-        os.environ["AZURE_COSMOS_AAD_SCOPE_OVERRIDE"] = ""
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_AAD_SCOPE_OVERRIDE="")
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
 
         class FallbackCredential(CosmosEmulatorCredential):
             def __init__(self):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
index 53ef61bb88a4..0937c1726956 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
@@ -716,9 +716,11 @@ def test_no_cross_region_request_with_retry_write_disabled(self, operation):
     @pytest.mark.parametrize("operation", [READ, QUERY_PK, CHANGE_FEED, CREATE, UPSERT, REPLACE, DELETE, PATCH, BATCH])
     def test_per_partition_circular_breaker_with_cancelled_first_future(self, operation):
         # QUERY, READ_ALL are not included because currently they are not targeting to a specific pkRange
-        os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
-        os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE"] = "5"
-        os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ"] = "5"
+        previous_env = test_config.set_environment_variables(
+            AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True",
+            AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE="5",
+            AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ="5",
+        )
 
         try:
             """Test that when per partition circular breaker is enabled and after hitting the threshold, subsequent requests go directly to second region.
@@ -799,9 +801,7 @@ def test_per_partition_circular_breaker_with_cancelled_first_future(self, operat
                     availability_strategy=strategy)
 
         finally:
-            del os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"]
-            del os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE"]
-            del os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ"]
+            test_config.restore_environment_variables(previous_env)
 
         self._clean_up_container(setup_with_fault_injection['db'].id, setup_with_fault_injection['col'].id)
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
index 2017c6d7a9dd..358d222365bd 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
@@ -847,9 +847,11 @@ async def test_no_cross_region_request_with_exclude_regions_async(self, operatio
     @pytest.mark.parametrize("operation", [READ, QUERY_PK, CHANGE_FEED, CREATE, UPSERT, REPLACE, DELETE, PATCH, BATCH])
     async def test_per_partition_circular_breaker_with_cancelled_first_future_async(self, operation, setup):
         # QUERY, READ_ALL are not included because currently they are not targeting to a specific pkRange
-        os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
-        os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE"] = "5"
-        os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ"] = "5"
+        previous_env = test_config.set_environment_variables(
+            AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True",
+            AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE="5",
+            AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ="5",
+        )
 
         try:
             """Test that when per partition circular breaker is enabled and after hitting the threshold, subsequent requests go directly to second region.
@@ -938,9 +940,7 @@ async def test_per_partition_circular_breaker_with_cancelled_first_future_async(
             await setup_with_fault_injection['client'].close()
             await setup_without_fault['client'].close()
         finally:
-            del os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"]
-            del os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_WRITE"]
-            del os.environ["AZURE_COSMOS_CONSECUTIVE_ERROR_COUNT_TOLERATED_FOR_READ"]
+            test_config.restore_environment_variables(previous_env)
         await self._clean_up_container(setup['client_without_fault'], setup_with_fault_injection['db'].id, setup_with_fault_injection['col'].id)
 
     @pytest.mark.asyncio
diff --git a/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator.py b/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator.py
index 4f7b9a6d3254..7ee7d2766a74 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator.py
@@ -22,9 +22,11 @@
 COLLECTION = "created_collection"
 @pytest.fixture(scope="class", autouse=True)
 def setup_teardown():
-    os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
-    yield
-    os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "False"
+    previous_env = test_config.set_environment_variables(AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True")
+    try:
+        yield
+    finally:
+        test_config.restore_environment_variables(previous_env)
 
 def create_custom_transport_mm():
     custom_transport = FaultInjectionTransport()
@@ -217,7 +219,7 @@ def test_write_failure_rate_threshold_delete_all_items_by_pk_mm(self, setup_tear
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -245,7 +247,7 @@ def test_write_failure_rate_threshold_delete_all_items_by_pk_mm(self, setup_tear
             validate_unhealthy_partitions_mm(global_endpoint_manager, 1)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
 
@@ -258,7 +260,7 @@ def test_write_failure_rate_threshold_delete_all_items_by_pk_sm(self, setup_tear
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -286,7 +288,7 @@ def test_write_failure_rate_threshold_delete_all_items_by_pk_sm(self, setup_tear
             validate_unhealthy_partitions_sm_mrr(global_endpoint_manager, 0)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator_async.py b/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator_async.py
index d04a54dcc5dd..130e45e18226 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_circuit_breaker_emulator_async.py
@@ -25,9 +25,11 @@
 COLLECTION = "created_collection"
 @pytest_asyncio.fixture(scope="class", loop_scope="class", autouse=True)
 async def setup_teardown():
-    os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
-    yield
-    os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "False"
+    previous_env = test_config.set_environment_variables(AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True")
+    try:
+        yield
+    finally:
+        test_config.restore_environment_variables(previous_env)
 
 async def create_custom_transport_mm():
     custom_transport = FaultInjectionTransportAsync()
@@ -223,7 +225,7 @@ async def test_write_failure_rate_threshold_delete_all_items_by_pk_mm_async(self
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -251,7 +253,7 @@ async def test_write_failure_rate_threshold_delete_all_items_by_pk_mm_async(self
             validate_unhealthy_partitions_mm(global_endpoint_manager, 1)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
         await cleanup_method([custom_setup, setup])
@@ -265,7 +267,7 @@ async def test_write_failure_rate_threshold_delete_all_items_by_pk_sm_async(self
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -293,7 +295,7 @@ async def test_write_failure_rate_threshold_delete_all_items_by_pk_sm_async(self
             validate_unhealthy_partitions_sm_mrr(global_endpoint_manager, 0)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
         await cleanup_method([custom_setup, setup])
diff --git a/sdk/cosmos/azure-cosmos/tests/test_config.py b/sdk/cosmos/azure-cosmos/tests/test_config.py
index a75d6120a33e..bd0f5f04e141 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_config.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_config.py
@@ -69,6 +69,31 @@ def unique_database_id(label=""):
     return "-".join(parts)
 
 
+def set_environment_variables(**overrides):
+    """Apply environment variable overrides and return the values they replaced.
+
+    Tests that toggle SDK feature flags must put the process back exactly as they found
+    it, because several of those flags are also set for the whole job by the pipeline.
+    Restoring an assumed default instead of the captured value silently disables the
+    feature under test for everything that runs later in the same process.
+
+    Pass a ``None`` value to unset a variable. Hand the return value to
+    :func:`restore_environment_variables` from a ``finally`` block.
+    """
+    previous = {name: os.environ.get(name) for name in overrides}
+    restore_environment_variables(overrides)
+    return previous
+
+
+def restore_environment_variables(previous):
+    """Reapply the environment variable values captured by :func:`set_environment_variables`."""
+    for name, value in previous.items():
+        if value is None:
+            os.environ.pop(name, None)
+        else:
+            os.environ[name] = value
+
+
 class TestConfig(object):
     local_host = 'https://localhost:8081/'
     # [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Cosmos DB Emulator Key")]
diff --git a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm.py b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm.py
index 37f03c6a9011..f93cf9a3c692 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm.py
@@ -323,7 +323,7 @@ def test_write_failure_rate_threshold(self, write_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -351,7 +351,7 @@ def test_write_failure_rate_threshold(self, write_operation, error):
             validate_unhealthy_partitions(global_endpoint_manager, 1)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
 
@@ -367,7 +367,7 @@ def test_read_failure_rate_threshold(self, read_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 8
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             if isinstance(error, ServiceResponseError):
                 # service response error retries in region 3 additional times before failing over
@@ -390,7 +390,7 @@ def test_read_failure_rate_threshold(self, read_operation, error):
 
             validate_unhealthy_partitions(global_endpoint_manager, expected_unhealthy_partitions)
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm_async.py b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm_async.py
index ea65ee23fbee..e7695f043cce 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_mm_async.py
@@ -268,7 +268,7 @@ async def test_write_failure_rate_threshold_async(self, write_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -296,7 +296,7 @@ async def test_write_failure_rate_threshold_async(self, write_operation, error):
             validate_unhealthy_partitions(global_endpoint_manager, 1)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
         await cleanup_method([custom_setup, setup])
@@ -315,7 +315,7 @@ async def test_read_failure_rate_threshold_async(self, read_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 8
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             if isinstance(error, ServiceResponseError):
                 # service response error retries in region 3 additional times before failing over
@@ -338,7 +338,7 @@ async def test_read_failure_rate_threshold_async(self, read_operation, error):
 
             validate_unhealthy_partitions(global_endpoint_manager, expected_unhealthy_partitions)
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
         await cleanup_method([custom_setup, setup])
diff --git a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr.py b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr.py
index d5ad7da36c91..1a67a0dde933 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr.py
@@ -155,7 +155,7 @@ def test_write_failure_rate_threshold(self, write_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -183,7 +183,7 @@ def test_write_failure_rate_threshold(self, write_operation, error):
             validate_unhealthy_partitions(global_endpoint_manager, 0)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr_async.py b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr_async.py
index 34c63b572ee9..6bb89d80f33b 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_per_partition_circuit_breaker_sm_mrr_async.py
@@ -108,7 +108,7 @@ async def test_write_failure_rate_threshold_async(self, write_operation, error):
         global_endpoint_manager = fault_injection_container.client_connection._global_endpoint_manager
         # lower minimum requests for testing
         _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 10
-        os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "80"
+        previous_env = test_config.set_environment_variables(AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED="80")
         try:
             # writes should fail but still be tracked and mark unavailable a partition after crossing threshold
             for i in range(10):
@@ -136,7 +136,7 @@ async def test_write_failure_rate_threshold_async(self, write_operation, error):
             validate_unhealthy_partitions(global_endpoint_manager, 0)
 
         finally:
-            os.environ["AZURE_COSMOS_FAILURE_PERCENTAGE_TOLERATED"] = "90"
+            test_config.restore_environment_variables(previous_env)
             # restore minimum requests
             _partition_health_tracker.MINIMUM_REQUESTS_FOR_FAILURE_RATE = 100
         await cleanup_method([custom_setup, setup])
diff --git a/sdk/cosmos/azure-cosmos/tests/test_retry_policy.py b/sdk/cosmos/azure-cosmos/tests/test_retry_policy.py
index 8a45f22abedf..69c3a9a41f18 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_retry_policy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_retry_policy.py
@@ -489,10 +489,13 @@ def test_patch_replace_no_retry(self):
 
 
     def test_health_check_retry_policy(self):
-        os.environ['AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES'] = '5'
-        os.environ['AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS'] = '2'
-        max_retries = int(os.environ['AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES'])
-        retry_after_ms = int(os.environ['AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS'])
+        max_retries = 5
+        retry_after_ms = 2
+        previous_env = test_config.set_environment_variables(
+            AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES=str(max_retries),
+            AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS=str(retry_after_ms),
+        )
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
         self.original_execute_function = _retry_utility.ExecuteFunction
         mock_execute = self.MockExecuteFunctionHealthCheck(self.original_execute_function)
         _retry_utility.ExecuteFunction = mock_execute
@@ -508,8 +511,6 @@ def test_health_check_retry_policy(self):
             policy = HealthCheckRetryPolicy(self.connectionPolicy)
             self.assertEqual(policy.retry_after_in_milliseconds, retry_after_ms)
         finally:
-            del os.environ["AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES"]
-            del os.environ["AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS"]
             _retry_utility.ExecuteFunction = self.original_execute_function
 
     def test_health_check_retry_policy_defaults(self):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_retry_policy_async.py b/sdk/cosmos/azure-cosmos/tests/test_retry_policy_async.py
index 6cf77d0a4498..180d56ab975c 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_retry_policy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_retry_policy_async.py
@@ -542,10 +542,13 @@ async def test_patch_replace_no_retry_async(self):
         await initialized_objects["client"].close()
 
     async def test_health_check_retry_policy_async(self):
-        os.environ['AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES'] = '5'
-        os.environ['AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS'] = '2'
-        max_retries = int(os.environ['AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES'])
-        retry_after_ms = int(os.environ['AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS'])
+        max_retries = 5
+        retry_after_ms = 2
+        previous_env = test_config.set_environment_variables(
+            AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES=str(max_retries),
+            AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS=str(retry_after_ms),
+        )
+        self.addCleanup(test_config.restore_environment_variables, previous_env)
         self.original_execute_function = _retry_utility.ExecuteFunctionAsync
         mock_execute = self.MockExecuteFunctionHealthCheck(self.original_execute_function)
         _retry_utility.ExecuteFunctionAsync = mock_execute
@@ -563,8 +566,6 @@ async def test_health_check_retry_policy_async(self):
             policy = HealthCheckRetryPolicy(ConnectionPolicy())
             self.assertEqual(policy.retry_after_in_milliseconds, retry_after_ms)
         finally:
-            del os.environ["AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES"]
-            del os.environ["AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS"]
             _retry_utility.ExecuteFunctionAsync = self.original_execute_function
 
     async def test_health_check_retry_policy_defaults_async(self):
diff --git a/sdk/cosmos/azure-cosmos/tests/test_session_token_unit.py b/sdk/cosmos/azure-cosmos/tests/test_session_token_unit.py
index 0c5de8578251..9930231d4306 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_session_token_unit.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_session_token_unit.py
@@ -208,18 +208,20 @@ def _different_merge_scenarios(self):
 
     def test_validate_session_token_comparison(self):
         self._different_merge_scenarios()
-        os.environ["AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE"] = "false"
-        self._different_merge_scenarios()
-        del os.environ["AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE"]
+        with mock.patch.dict(os.environ, {"AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE": "false"}):
+            self._different_merge_scenarios()
 
     def test_session_token_false_progress_merge(self):
         for false_progress_enabled in [True, False]:
-            self.validate_different_session_token_false_progress_merge_scenarios(false_progress_enabled)
+            with mock.patch.dict(
+                os.environ,
+                {"AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE": str(false_progress_enabled)},
+            ):
+                self.validate_different_session_token_false_progress_merge_scenarios(false_progress_enabled)
 
     def validate_different_session_token_false_progress_merge_scenarios(self, false_progress_enabled: bool):
         # Test that false progress merge is enabled by default and that global lsn is used from higher version token
         # when enabled
-        os.environ["AZURE_COSMOS_SESSION_TOKEN_FALSE_PROGRESS_MERGE"] = str(false_progress_enabled)
         session_token1 = VectorSessionToken.create("1#200#1=20#2=5#3=30")
         session_token2 = VectorSessionToken.create("2#100#1=10#2=8#3=30")
         self.assertIsNotNone(session_token1)
diff --git a/sdk/cosmos/azure-cosmos/tests/test_user_agent.py b/sdk/cosmos/azure-cosmos/tests/test_user_agent.py
index c57cf09880ce..51eef295b5e9 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_user_agent.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_user_agent.py
@@ -58,10 +58,10 @@ def test_user_agent_special_characters(self):
 
     def test_user_agent_with_features(self):
         def _run_case(use_suffix: bool) -> None:
-            os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
             user_agent_value = "customString"
             mock_handler = test_config.MockHandler()
             logger = create_logger("testloggerdefault_sync", mock_handler)
+            previous_env = test_config.set_environment_variables(AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True")
             try:
                 kwargs: dict[str, Any] = {"logger": logger}
                 if use_suffix:
@@ -74,7 +74,7 @@ def _run_case(use_suffix: bool) -> None:
                 container.create_item(body={"id": "testItem" + str(uuid.uuid4()), "content": "testContent"})
                 container.create_item(body={"id": "testItem" + str(uuid.uuid4()), "content": "testContent"})
             finally:
-                os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "False"
+                test_config.restore_environment_variables(previous_env)
 
             # Examine log messages for User-Agent header
             for log_message in mock_handler.messages:
diff --git a/sdk/cosmos/azure-cosmos/tests/test_user_agent_async.py b/sdk/cosmos/azure-cosmos/tests/test_user_agent_async.py
index af6cd1ba9486..a5655a5554c2 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_user_agent_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_user_agent_async.py
@@ -47,10 +47,10 @@ async def test_user_agent_special_characters_async(self):
 
     async def test_user_agent_with_features_async(self):
         async def _run_case(use_suffix: bool):
-            os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "True"
             user_agent = "customString"
             mock_handler = test_config.MockHandler()
             logger = create_logger("testloggerdefault_async", mock_handler)
+            previous_env = test_config.set_environment_variables(AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER="True")
             try:
                 kwargs: dict[str, Any] = {"logger": logger}
                 if use_suffix:
@@ -63,7 +63,7 @@ async def _run_case(use_suffix: bool):
                 await container.create_item(body={"id": "testItem" + str(uuid.uuid4()), "content": "testContent"})
                 await container.create_item(body={"id": "testItem" + str(uuid.uuid4()), "content": "testContent"})
             finally:
-                os.environ["AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER"] = "False"
+                test_config.restore_environment_variables(previous_env)
 
             log_messages = mock_handler.messages
             for log_message in log_messages:

From ce8e7e5c1d4cd530986718c763f53caa5593c4d4 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:35:30 -0400
Subject: [PATCH 3/7] [cosmos] Make live tests tolerate a shared, contended
 account

Three changes that only matter once the suite stops getting a freshly
provisioned account per run.

cosmos-staging.yml swept the account with an unfiltered
"for db in client.list_databases(): client.delete_database(db['id'])" plus an
equivalent Remove-AzCosmosDBSqlDatabase pipeline task. Against a long-lived
account shared with other languages' CI that deletes resources still in use, so
both cleanups are now scoped to the PythonSDKTest-<build id>- prefix this run
creates. (The pipeline looks vestigial -- it is an export of a classic pipeline
and nothing in the repo references it -- but making it safe is cheap and does
not depend on settling that question.)

test_backwards_compatibility{,_async} asserted len(list_databases()) > 0 after
creating a database, which passes on a shared account whether or not the
database under test exists. It now asserts the run's own database and container
appear in the listings, which is both isolation-safe and a stronger check.

Setup and teardown now go through test_config.retry_control_plane, which
retries 408/429/449/500/503 with jittered backoff, preferring the service's
x-ms-retry-after-ms hint. The account control plane is shared, so database and
container create/delete can fail purely because another run is busy on the same
account, and the SDK's built-in throttle retry gives up after ~30s. 400/401/403/
404/409 are deliberately not retried so negative tests still fail fast. An async
variant is provided for callers that create resources directly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 .../tests/test_backwards_compatibility.py     | 22 +++--
 .../test_backwards_compatibility_async.py     | 22 +++--
 sdk/cosmos/azure-cosmos/tests/test_config.py  | 84 ++++++++++++++++---
 sdk/cosmos/cosmos-staging.yml                 | 46 +++++++---
 4 files changed, 136 insertions(+), 38 deletions(-)

diff --git a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
index 19a664d40505..685fa22df8b2 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility.py
@@ -68,10 +68,14 @@ def test_session_token_compatibility(self):
         assert database is not None
         database2 = self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database2 is not None
-        database_list = list(self.client.list_databases(session_token=str(uuid.uuid4())))
-        database_list2 = list(self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4())))
-        assert len(database_list) > 0
-        assert len(database_list2) > 0
+        # Assert this run's own database is present rather than that the account is
+        # non-empty: the account is shared with other runs and other language SDKs, so a
+        # non-zero count says nothing about the database under test.
+        database_ids = {db['id'] for db in self.client.list_databases(session_token=str(uuid.uuid4()))}
+        database_ids2 = {db['id'] for db in
+                         self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4()))}
+        assert database.id in database_ids
+        assert database.id in database_ids2
         database_read = database.read(session_token=str(uuid.uuid4()))
         assert database_read is not None
         self.client.delete_database(database2.id, session_token=str(uuid.uuid4()))
@@ -86,10 +90,12 @@ def test_session_token_compatibility(self):
         assert container is not None
         container2 = self.databaseForTest.create_container_if_not_exists(str(uuid.uuid4()), PartitionKey(path="/pk"), session_token=str(uuid.uuid4()))
         assert container2 is not None
-        container_list = list(self.databaseForTest.list_containers(session_token=str(uuid.uuid4())))
-        container_list2 = list(self.databaseForTest.query_containers(query="select * from c", session_token=str(uuid.uuid4())))
-        assert len(container_list) > 0
-        assert len(container_list2) > 0
+        container_ids = {c['id'] for c in self.databaseForTest.list_containers(session_token=str(uuid.uuid4()))}
+        container_ids2 = {c['id'] for c in
+                          self.databaseForTest.query_containers(query="select * from c",
+                                                                session_token=str(uuid.uuid4()))}
+        assert container.id in container_ids
+        assert container.id in container_ids2
         container2_read = container2.read(session_token=str(uuid.uuid4()))
         assert container2_read is not None
         replace_container = self.databaseForTest.replace_container(container2, PartitionKey(path="/pk"), default_ttl=30, session_token=str(uuid.uuid4()))
diff --git a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
index bcd391be9e0d..db27032af6f6 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_backwards_compatibility_async.py
@@ -51,10 +51,14 @@ async def test_session_token_compatibility_async(self):
         assert database is not None
         database2 = await self.client.create_database_if_not_exists(test_config.unique_database_id("backcompat"), session_token=str(uuid.uuid4()))
         assert database2 is not None
-        database_list = [db async for db in self.client.list_databases(session_token=str(uuid.uuid4()))]
-        database_list2 = [db async for db in self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4()))]
-        assert len(database_list) > 0
-        assert len(database_list2) > 0
+        # Assert this run's own database is present rather than that the account is
+        # non-empty: the account is shared with other runs and other language SDKs, so a
+        # non-zero count says nothing about the database under test.
+        database_ids = {db['id'] async for db in self.client.list_databases(session_token=str(uuid.uuid4()))}
+        database_ids2 = {db['id'] async for db in
+                         self.client.query_databases(query="select * from c", session_token=str(uuid.uuid4()))}
+        assert database.id in database_ids
+        assert database.id in database_ids2
         database_read = await database.read(session_token=str(uuid.uuid4()))
         assert database_read is not None
         await self.client.delete_database(database2.id, session_token=str(uuid.uuid4()))
@@ -69,10 +73,12 @@ async def test_session_token_compatibility_async(self):
         assert container is not None
         container2 = await self.created_database.create_container_if_not_exists(str(uuid.uuid4()), PartitionKey(path="/pk"), session_token=str(uuid.uuid4()))
         assert container2 is not None
-        container_list = [cont async for cont in self.created_database.list_containers(session_token=str(uuid.uuid4()))]
-        container_list2 = [cont async for cont in self.created_database.query_containers(query="select * from c", session_token=str(uuid.uuid4()))]
-        assert len(container_list) > 0
-        assert len(container_list2) > 0
+        container_ids = {c['id'] async for c in self.created_database.list_containers(session_token=str(uuid.uuid4()))}
+        container_ids2 = {c['id'] async for c in
+                          self.created_database.query_containers(query="select * from c",
+                                                                 session_token=str(uuid.uuid4()))}
+        assert container.id in container_ids
+        assert container.id in container_ids2
         container2_read = await container2.read(session_token=str(uuid.uuid4()))
         assert container2_read is not None
         replace_container = await self.created_database.replace_container(container2, PartitionKey(path="/pk"), default_ttl=30, session_token=str(uuid.uuid4()))
diff --git a/sdk/cosmos/azure-cosmos/tests/test_config.py b/sdk/cosmos/azure-cosmos/tests/test_config.py
index bd0f5f04e141..d078418537e7 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_config.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_config.py
@@ -94,6 +94,65 @@ def restore_environment_variables(previous):
             os.environ[name] = value
 
 
+# The live-test accounts are long lived and shared with concurrent runs of this suite and
+# with other language SDKs' CI, so the account control plane is a contended resource:
+# creating or deleting a database or container can fail purely because someone else is
+# busy on the same account. The SDK's own throttle retry gives up after ~30s, which is not
+# enough headroom for suite setup and teardown on a busy account.
+CONTROL_PLANE_MAX_ATTEMPTS = 20
+CONTROL_PLANE_MAX_BACKOFF_SECONDS = 15
+# Retried: request timeout, throttled, retry-with, internal error, service unavailable.
+# Deliberately absent: 400, 401, 403, 404, 409. Those describe the request itself, so
+# negative tests that assert on them must keep failing fast.
+CONTROL_PLANE_RETRY_STATUS_CODES = frozenset({408, 429, 449, 500, 503})
+
+
+def _control_plane_backoff(attempt, error):
+    """Seconds to wait before retrying, preferring the service's own hint."""
+    headers = getattr(error, "headers", None) or {}
+    for header in (HttpHeaders.RetryAfterInMilliseconds, HttpHeaders.RetryAfter):
+        raw = headers.get(header)
+        if raw is None:
+            continue
+        try:
+            hinted = float(raw) / 1000 if header == HttpHeaders.RetryAfterInMilliseconds else float(raw)
+        except (TypeError, ValueError):
+            continue
+        return min(max(hinted, 0.1), CONTROL_PLANE_MAX_BACKOFF_SECONDS)
+    backoff = min(0.5 * (2 ** attempt), CONTROL_PLANE_MAX_BACKOFF_SECONDS)
+    # Jitter so that parallel matrix legs retrying the same account don't stay in lockstep.
+    return backoff * (0.5 + random.random() / 2)
+
+
+def _should_retry_control_plane(error, attempt):
+    return (error.status_code in CONTROL_PLANE_RETRY_STATUS_CODES
+            and attempt < CONTROL_PLANE_MAX_ATTEMPTS - 1)
+
+
+def retry_control_plane(operation, *args, **kwargs):
+    """Run a control-plane operation, retrying transient service-side failures."""
+    for attempt in range(CONTROL_PLANE_MAX_ATTEMPTS):
+        try:
+            return operation(*args, **kwargs)
+        except exceptions.CosmosHttpResponseError as error:
+            if not _should_retry_control_plane(error, attempt):
+                raise
+            time.sleep(_control_plane_backoff(attempt, error))
+    raise AssertionError("unreachable")  # pragma: no cover
+
+
+async def retry_control_plane_async(operation, *args, **kwargs):
+    """Async counterpart of :func:`retry_control_plane`."""
+    for attempt in range(CONTROL_PLANE_MAX_ATTEMPTS):
+        try:
+            return await operation(*args, **kwargs)
+        except exceptions.CosmosHttpResponseError as error:
+            if not _should_retry_control_plane(error, attempt):
+                raise
+            await asyncio.sleep(_control_plane_backoff(attempt, error))
+    raise AssertionError("unreachable")  # pragma: no cover
+
+
 class TestConfig(object):
     local_host = 'https://localhost:8081/'
     # [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Cosmos DB Emulator Key")]
@@ -259,15 +318,17 @@ def get_account_info(cls, client: CosmosClient):
     @classmethod
     def create_database_if_not_exist(cls, client):
         # type: (CosmosClient) -> DatabaseProxy
-        test_database = client.create_database_if_not_exists(cls.TEST_DATABASE_ID,
-                                                             offer_throughput=cls.THROUGHPUT_FOR_1_PARTITION)
+        test_database = retry_control_plane(client.create_database_if_not_exists,
+                                            cls.TEST_DATABASE_ID,
+                                            offer_throughput=cls.THROUGHPUT_FOR_1_PARTITION)
         return test_database
 
     @classmethod
     def create_single_partition_container_if_not_exist(cls, client):
         # type: (CosmosClient) -> ContainerProxy
         database = cls.create_database_if_not_exist(client)
-        document_collection = database.create_container_if_not_exists(
+        document_collection = retry_control_plane(
+            database.create_container_if_not_exists,
             id=cls.TEST_SINGLE_PARTITION_CONTAINER_ID,
             partition_key=PartitionKey(path='/' + cls.TEST_CONTAINER_PARTITION_KEY, kind='Hash'),
             offer_throughput=cls.THROUGHPUT_FOR_1_PARTITION)
@@ -277,7 +338,8 @@ def create_single_partition_container_if_not_exist(cls, client):
     def create_multi_partition_container_if_not_exist(cls, client):
         # type: (CosmosClient) -> ContainerProxy
         database = cls.create_database_if_not_exist(client)
-        document_collection = database.create_container_if_not_exists(
+        document_collection = retry_control_plane(
+            database.create_container_if_not_exists,
             id=cls.TEST_MULTI_PARTITION_CONTAINER_ID,
             partition_key=PartitionKey(path='/' + cls.TEST_CONTAINER_PARTITION_KEY, kind='Hash'),
             offer_throughput=cls.THROUGHPUT_FOR_5_PARTITIONS)
@@ -287,7 +349,8 @@ def create_multi_partition_container_if_not_exist(cls, client):
     def create_single_partition_prefix_pk_container_if_not_exist(cls, client):
         # type: (CosmosClient) -> ContainerProxy
         database = cls.create_database_if_not_exist(client)
-        document_collection = database.create_container_if_not_exists(
+        document_collection = retry_control_plane(
+            database.create_container_if_not_exists,
             id=cls.TEST_SINGLE_PARTITION_PREFIX_PK_CONTAINER_ID,
             partition_key=PartitionKey(path=cls.TEST_CONTAINER_PREFIX_PARTITION_KEY_PATH, kind='MultiHash'),
             offer_throughput=cls.THROUGHPUT_FOR_1_PARTITION)
@@ -297,7 +360,8 @@ def create_single_partition_prefix_pk_container_if_not_exist(cls, client):
     def create_multi_partition_prefix_pk_container_if_not_exist(cls, client):
         # type: (CosmosClient) -> ContainerProxy
         database = cls.create_database_if_not_exist(client)
-        document_collection = database.create_container_if_not_exists(
+        document_collection = retry_control_plane(
+            database.create_container_if_not_exists,
             id=cls.TEST_MULTI_PARTITION_PREFIX_PK_CONTAINER_ID,
             partition_key=PartitionKey(path=cls.TEST_CONTAINER_PREFIX_PARTITION_KEY_PATH, kind='MultiHash'),
             offer_throughput=cls.THROUGHPUT_FOR_5_PARTITIONS)
@@ -306,17 +370,13 @@ def create_multi_partition_prefix_pk_container_if_not_exist(cls, client):
     @classmethod
     def try_delete_database(cls, client):
         # type: (CosmosClient) -> None
-        try:
-            client.delete_database(cls.TEST_DATABASE_ID)
-        except exceptions.CosmosHttpResponseError as e:
-            if e.status_code != StatusCodes.NOT_FOUND:
-                raise e
+        cls.try_delete_database_with_id(client, cls.TEST_DATABASE_ID)
 
     @classmethod
     def try_delete_database_with_id(cls, client, database_id):
         # type: (CosmosClient, str) -> None
         try:
-            client.delete_database(database_id)
+            retry_control_plane(client.delete_database, database_id)
         except exceptions.CosmosHttpResponseError as e:
             if e.status_code != StatusCodes.NOT_FOUND:
                 raise e
diff --git a/sdk/cosmos/cosmos-staging.yml b/sdk/cosmos/cosmos-staging.yml
index 5cb9e090d290..5b7d7529e0f0 100644
--- a/sdk/cosmos/cosmos-staging.yml
+++ b/sdk/cosmos/cosmos-staging.yml
@@ -46,7 +46,32 @@ jobs:
     inputs:
       ConnectedServiceNameARM: d71e80c4-c3df-4a27-9fc7-f25563bbb0d1
       ScriptType: InlineScript
-      Inline: "$uri = New-Object System.Uri(\"${env:ACCOUNT_HOST}\")\n\n$accountName = $uri.Host.Split('.')[0]\nWrite-Host \"Clean up databases from $accountName\"\n\n$res = Get-AzResource -Name $accountName -ResourceType \"Microsoft.DocumentDb/databaseAccounts\"\n\nif ($res -ne $null) {\n\n    $account = Get-AzCosmosDBAccount -ResourceId $res.ResourceId\n\n    $dbs = Get-AzCosmosDBSqlDatabase -ParentObject $account\n\n    $dbs | Write-Output\n\n    $dbs | Remove-AzCosmosDBSqlDatabase\n    \n    Write-Host \"$accountName is cleaned\"\n}\nelse {\n   Write-Host \"Unable to find $accountName\"\n}"
+      Inline: |
+        $uri = New-Object System.Uri("${env:ACCOUNT_HOST}")
+        $accountName = $uri.Host.Split('.')[0]
+
+        # Only remove databases this pipeline run created. The account is long lived and
+        # shared with other languages' CI and with concurrent runs of this suite, so an
+        # unfiltered sweep would delete resources that are still in use.
+        $prefix = "PythonSDKTest-$($env:BUILD_BUILDID)-"
+        Write-Host "Clean up databases matching '$prefix*' from $accountName"
+
+        $res = Get-AzResource -Name $accountName -ResourceType "Microsoft.DocumentDb/databaseAccounts"
+
+        if ($null -ne $res) {
+            $account = Get-AzCosmosDBAccount -ResourceId $res.ResourceId
+
+            $dbs = Get-AzCosmosDBSqlDatabase -ParentObject $account | Where-Object { $_.Name.StartsWith($prefix) }
+
+            $dbs | Write-Output
+
+            $dbs | Remove-AzCosmosDBSqlDatabase
+
+            Write-Host "$accountName is cleaned"
+        }
+        else {
+           Write-Host "Unable to find $accountName"
+        }
       errorActionPreference: continue
       TargetAzurePs: LatestVersion
   - task: Bash@3
@@ -60,24 +85,25 @@ jobs:
     condition: succeededOrFailed()
     inputs:
       scriptSource: inline
-      script: >-
-        # python tests creates databases with special characters (!@$%^&*()-~`'_[]{}|;:,.<>) and PS and Portal unable to remove them. This task additionally clean resource that couldn't be removed using previous PS task
-
-
+      script: |
+        # Python tests create databases with special characters (!@$%^&*()-~`'_[]{}|;:,.<>)
+        # that PS and the Portal are unable to remove. This task additionally cleans up
+        # resources that the previous PS task could not.
         import os
 
         import azure.cosmos.cosmos_client as cosmos_client
 
-        host = os.environ.get("ACCOUNT_HOST", "") 
-
+        host = os.environ.get("ACCOUNT_HOST", "")
         key = os.environ.get("ACCOUNT_KEY", "")
 
-        client = cosmos_client.CosmosClient(host, key)
+        # Scoped to this run for the same reason as the PS task above.
+        prefix = "PythonSDKTest-{}-".format(os.environ.get("BUILD_BUILDID", ""))
 
+        client = cosmos_client.CosmosClient(host, key)
 
         for db in client.list_databases():
-
-            client.delete_database(db["id"])
+            if db["id"].startswith(prefix):
+                client.delete_database(db["id"])
     env:
       ACCOUNT_KEY: $(ACCOUNT_KEY) # Maps the secret variable $(token) from my-var-group
 ...

From 8e198b30e66e1bf4d2c9cd5c57787bd5007ea811 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:52:30 -0400
Subject: [PATCH 4/7] [cosmos] Add the fixed-test-account resolver and the
 pipeline gate it needs

Ports azure-sdk-for-java#49735's account resolver so Python's Cosmos live tests can bind to
the fixed sdkci-* accounts in the Cosmos-owned CosmosDB_Test_Subscription instead of
provisioning an account per run. Per-run provisioning is what breaks every ~90 days when the
live-test tenant is recreated and every service principal and RBAC assignment with it.

Nothing is switched over yet: DisableAzureResourceCreation defaults to false and no matrix leg
sets AccountSelector, so this is inert until sdk/cosmos/tests.yml opts in.

sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1 reads the same secret, in the same schema,
naming the same accounts as the Java resolver, and applies the same validation. It is
PowerShell rather than Java's bash+jq because Python's matrix has five windows-2022 legs and a
macOS leg where neither bash nor jq is available; pwsh and ConvertFrom-Json need no install.
It emits only ACCOUNT_HOST/ACCOUNT_KEY -- consistency, preferred locations and
AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER stay owned by live-platform-matrix.json, and a test
asserts that.

Keys use the double-set convention already in eng/common/TestResources/TestResources-Helpers.ps1:
_ACCOUNT_KEY as a secret so the scrubber masks it, plus a plain ACCOUNT_KEY so it still reaches
the test process, since issecret=true suppresses environment propagation. Added on top of the
Java version: a case-sensitive selector match, so a matrix typo cannot silently bind a leg to
the wrong account, and a rejection of values containing line breaks, which would otherwise
truncate the logging command and print the rest of the key unscrubbed.

live.tests.yml and archetype-sdk-tests.yml gain DisableAzureResourceCreation to skip the ARM
deploy/remove pair. live.tests.yml also now forwards BeforeTestSteps/AfterTestSteps to
build-test.yml: it declared both parameters but never passed them on, so anything a service
supplied was silently dropped. Nothing in sdk/ sets them today, so wiring them up changes no
existing behaviour -- but the resolver depends on it, because build-test.yml is where those
steps run in the same job as the pytest task, which is what lets a published pipeline variable
reach the tests as an environment variable.

AAD legs are deliberately left on the provisioning path: test-resources.bicep creates a
sqlRoleAssignment for testApplicationOid, and that principal is tenant-scoped. Legs with no
AccountSelector skip the resolver step.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 eng/pipelines/templates/jobs/live.tests.yml   |  69 +++--
 .../templates/stages/archetype-sdk-tests.yml  |   7 +
 sdk/cosmos/pipeline/README.md                 | 125 +++++++++
 .../pipeline/resolve-cosmos-test-account.ps1  | 180 +++++++++++++
 .../resolve-cosmos-test-account.tests.ps1     | 249 ++++++++++++++++++
 .../pipeline/resolve-test-account-steps.yml   |  35 +++
 6 files changed, 639 insertions(+), 26 deletions(-)
 create mode 100644 sdk/cosmos/pipeline/README.md
 create mode 100644 sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
 create mode 100644 sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
 create mode 100644 sdk/cosmos/pipeline/resolve-test-account-steps.yml

diff --git a/eng/pipelines/templates/jobs/live.tests.yml b/eng/pipelines/templates/jobs/live.tests.yml
index c7e57c37b6bd..a73523cb0a45 100644
--- a/eng/pipelines/templates/jobs/live.tests.yml
+++ b/eng/pipelines/templates/jobs/live.tests.yml
@@ -69,6 +69,15 @@ parameters:
   - name: PersistOidcToken
     type: boolean
     default: false
+  # When true, skip the per-run ARM deployment (and its matching teardown) entirely.
+  # Intended for services whose live tests run against fixed, team-owned accounts resolved
+  # in BeforeTestSteps rather than provisioned per run -- see sdk/cosmos/pipeline/README.md.
+  # The azure-sdk live-test tenant is recreated roughly every 90 days, which invalidates the
+  # service principals and RBAC that New-TestResources.ps1 depends on, so per-run provisioning
+  # fails until a human re-onboards the tenant.
+  - name: DisableAzureResourceCreation
+    type: boolean
+    default: false
 
 jobs:
   - job:
@@ -143,30 +152,31 @@ jobs:
         parameters:
           BuildTargetingString: ${{ parameters.BuildTargetingString }}
 
-      - template: /eng/common/TestResources/build-test-resource-config.yml
-        parameters:
-          SubscriptionConfiguration: ${{ parameters.CloudConfig.SubscriptionConfiguration }}
-          SubscriptionConfigurations: ${{ parameters.CloudConfig.SubscriptionConfigurations }}
-          ${{ if parameters.UseFederatedAuth }}:
-            SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths }}
-          EnvVars:
-            Pool: $(Pool)
-            ${{ insert }}: ${{ parameters.EnvVars }}
-
-      - ${{ each directory in coalesce(parameters.TestResourceDirectories, split(parameters.ServiceDirectory, '|')) }}:
-        - template: /eng/common/TestResources/deploy-test-resources.yml
+      - ${{ if not(parameters.DisableAzureResourceCreation) }}:
+        - template: /eng/common/TestResources/build-test-resource-config.yml
           parameters:
-            Location: ${{ coalesce(parameters.Location, parameters.CloudConfig.Location) }}
-            ServiceDirectory: '${{ directory }}'
-            SubscriptionConfiguration: $(SubscriptionConfiguration)
-            ArmTemplateParameters: $(ArmTemplateParameters)
-            UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
-            PersistOidcToken: ${{ parameters.PersistOidcToken }}
-            ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
+            SubscriptionConfiguration: ${{ parameters.CloudConfig.SubscriptionConfiguration }}
+            SubscriptionConfigurations: ${{ parameters.CloudConfig.SubscriptionConfigurations }}
+            ${{ if parameters.UseFederatedAuth }}:
+              SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths }}
             EnvVars:
               Pool: $(Pool)
               ${{ insert }}: ${{ parameters.EnvVars }}
 
+        - ${{ each directory in coalesce(parameters.TestResourceDirectories, split(parameters.ServiceDirectory, '|')) }}:
+          - template: /eng/common/TestResources/deploy-test-resources.yml
+            parameters:
+              Location: ${{ coalesce(parameters.Location, parameters.CloudConfig.Location) }}
+              ServiceDirectory: '${{ directory }}'
+              SubscriptionConfiguration: $(SubscriptionConfiguration)
+              ArmTemplateParameters: $(ArmTemplateParameters)
+              UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
+              PersistOidcToken: ${{ parameters.PersistOidcToken }}
+              ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
+              EnvVars:
+                Pool: $(Pool)
+                ${{ insert }}: ${{ parameters.EnvVars }}
+
       # This is a heuristic to detect compiled requirements in the service 
       # directory. If compiled requirements are found, install dependencies for
       # and configure cibuildwheel. 
@@ -241,13 +251,20 @@ jobs:
           TestProxy: ${{ parameters.TestProxy }}
           UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
           ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
+          # build-test.yml runs these immediately before/after the test task, in the same job,
+          # so a BeforeTestSteps step can publish pipeline variables that the test task then
+          # picks up as environment variables. These were declared here but never forwarded,
+          # which silently dropped anything a service passed in via archetype-sdk-tests.yml.
+          BeforeTestSteps: ${{ parameters.BeforeTestSteps }}
+          AfterTestSteps: ${{ parameters.AfterTestSteps }}
 
-      - ${{ each directory in coalesce(parameters.TestResourceDirectories, split(parameters.ServiceDirectory, '|')) }}:
-        - template: /eng/common/TestResources/remove-test-resources.yml
-          parameters:
-            ServiceDirectory: '${{ directory }}'
-            SubscriptionConfiguration: $(SubscriptionConfiguration)
-            UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
-            ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
+      - ${{ if not(parameters.DisableAzureResourceCreation) }}:
+        - ${{ each directory in coalesce(parameters.TestResourceDirectories, split(parameters.ServiceDirectory, '|')) }}:
+          - template: /eng/common/TestResources/remove-test-resources.yml
+            parameters:
+              ServiceDirectory: '${{ directory }}'
+              SubscriptionConfiguration: $(SubscriptionConfiguration)
+              UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
+              ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
 
       - ${{ parameters.PostSteps }}
diff --git a/eng/pipelines/templates/stages/archetype-sdk-tests.yml b/eng/pipelines/templates/stages/archetype-sdk-tests.yml
index e6e84f1c8170..1c8971482eed 100644
--- a/eng/pipelines/templates/stages/archetype-sdk-tests.yml
+++ b/eng/pipelines/templates/stages/archetype-sdk-tests.yml
@@ -100,6 +100,12 @@ parameters:
   - name: PersistOidcToken
     type: boolean
     default: false
+  # Skip the per-run ARM deployment and its teardown for this stage. Use when the service's
+  # live tests bind to fixed, team-owned accounts (resolved in BeforeTestSteps) instead of
+  # provisioning per run. See sdk/cosmos/pipeline/README.md for the Cosmos implementation.
+  - name: DisableAzureResourceCreation
+    type: boolean
+    default: false
 
 extends:
   template: /eng/pipelines/templates/stages/1es-redirect.yml
@@ -146,6 +152,7 @@ extends:
                       CheckEnv: ${{ parameters.CheckEnv }}
                       UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
                       PersistOidcToken: ${{ parameters.PersistOidcToken }}
+                      DisableAzureResourceCreation: ${{ parameters.DisableAzureResourceCreation }}
                     MatrixConfigs:
                       # Enumerate platforms and additional platforms based on supported clouds (sparse platform<-->cloud matrix).
                       - ${{ each config in parameters.MatrixConfigs }}:
diff --git a/sdk/cosmos/pipeline/README.md b/sdk/cosmos/pipeline/README.md
new file mode 100644
index 000000000000..2f883b2dd946
--- /dev/null
+++ b/sdk/cosmos/pipeline/README.md
@@ -0,0 +1,125 @@
+# Cosmos live-test accounts
+
+The Cosmos live tests bind to **fixed, team-owned Cosmos DB accounts** instead of provisioning a
+new account on every pipeline run.
+
+## Why
+
+The azure-sdk live-test tenant is destroyed and recreated roughly every 90 days. Each rotation
+invalidates the service principals, the `azure-sdk-tests-cosmos` service connection and every RBAC
+assignment, so any run that calls `eng/common/TestResources/deploy-test-resources.yml` →
+`New-TestResources.ps1` fails on auth until a human re-onboards the tenant.
+
+Fixed accounts move that coupling to a single rotatable secret. On rotation, someone regenerates the
+accounts JSON and updates one variable — no repo change, no pipeline change.
+
+This mirrors [Azure/azure-sdk-for-java#49735](https://github.com/Azure/azure-sdk-for-java/pull/49735),
+and deliberately reads the **same secret, in the same schema, from the same accounts**. Tracking
+issue: [Azure/azure-sdk-for-python#48236](https://github.com/Azure/azure-sdk-for-python/issues/48236).
+
+## The accounts
+
+They live in resource group `sdk-ci` of the Cosmos-team-owned subscription
+`CosmosDB_Test_Subscription` (`54c97bd0-fc52-41c8-a5f2-faf722f1f417`), named `sdkci-<selector>`.
+That subscription is not part of the ephemeral tenant, which is the whole point.
+
+Java's `New-CosmosLiveTestAccounts.ps1` is the shared provisioning/rotation tool. **Do not duplicate
+it here** — Python consumes the same accounts and the same JSON.
+
+## Selector map
+
+| Selector | Shape | Python matrix legs |
+|---|---|---|
+| `single-session` | 1 region, Session | `cosmosQuery`, `cosmosLong` (×2), `cosmosSearchQuery` |
+| `single-session-split` | 1 region, Session, isolated | `cosmosSplit` (×2) |
+| `multiregion-tc-session` | 2 regions, Session, **single**-write | `cosmosCircuitBreakerMultiRegion`, `cosmosPerPartitionAutomaticFailover` |
+| `multimaster-multiregion-session` | 2 regions, Session, multi-write | `cosmosMultiRegion` (×3), `cosmosCircuitBreaker` |
+
+Python needs far fewer accounts than Java's 18 because it does not vary account consistency per leg
+and has no thin-client / HTTP-2 / pmerge / Kafka lanes.
+
+Notably the two circuit-breaker lanes need **no dedicated account**: `AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER`
+is a client-side SDK setting (`azure/cosmos/_constants.py`, `CIRCUIT_BREAKER_ENABLED_CONFIG`), and
+per-partition failures are injected in-process by `tests/_fault_injection_transport.py` rather than
+by degrading the real account. Per-partition automatic failover is likewise faked by rewriting the
+`GetDatabaseAccount` response. Those legs only need the right account *topology*.
+
+The region difference from the old bicep (Java's accounts are Central US / East US 2; the bicep used
+West US 3 / West Central US) is safe: `tests/test_config.py` reads `WRITE_LOCATION` / `READ_LOCATION`
+from `client.get_database_account()` at runtime, and no live test pins a region literal.
+
+## How a run binds to an account
+
+1. `sdk/cosmos/tests.yml` sets `DisableAzureResourceCreation: true`, so
+   `eng/pipelines/templates/jobs/live.tests.yml` skips both the ARM deployment and its teardown.
+2. Each matrix leg in `live-platform-matrix.json` sets `AccountSelector`.
+3. `resolve-test-account-steps.yml` runs in `BeforeTestSteps`, which
+   `eng/pipelines/templates/steps/build-test.yml` executes in the same job immediately before the
+   pytest task — so pipeline variables it publishes reach the tests as environment variables.
+4. `resolve-cosmos-test-account.ps1` reads the JSON secret, looks up the selector and publishes
+   `ACCOUNT_HOST` / `ACCOUNT_KEY`, which `tests/test_config.py` already consumes. No test-side change.
+
+### Why PowerShell and not Java's bash + jq
+
+The Python live matrix runs legs on `windows-2022` and macOS as well as Linux. Neither bash nor jq
+can be relied on there. `pwsh` ships on all three hosted images and `ConvertFrom-Json` removes the
+jq dependency entirely.
+
+### The double-set convention
+
+Keys are published twice:
+
+```
+##vso[task.setvariable variable=_ACCOUNT_KEY;issecret=true]<key>
+##vso[task.setvariable variable=ACCOUNT_KEY;issecret=false]<key>
+```
+
+The first registers the literal with the log scrubber so it is masked everywhere. The second is what
+actually reaches the test process — a variable marked `issecret=true` is deliberately *not*
+auto-exported as an environment variable, so on its own the tests would see no key at all. This is
+the same trick `eng/common/TestResources/TestResources-Helpers.ps1` uses for ARM outputs.
+
+### What the resolver deliberately does not emit
+
+Account consistency, preferred locations and `AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER` are per-leg
+concerns owned by `live-platform-matrix.json`. Emitting them from the resolver would clobber the
+matrix values and silently change what a lane tests. `resolve-cosmos-test-account.tests.ps1` asserts
+this.
+
+## AAD legs still provision
+
+The `cosmosAAD*` legs are **not** on fixed accounts. `test-resources.bicep` creates a custom
+`sqlRoleDefinition` plus a `sqlRoleAssignment` for `testApplicationOid`, and that principal is
+tenant-scoped — it changes on every rotation. Moving those legs onto the fixed accounts requires
+granting the test service principal a data-plane role assignment on the `sdk-ci` accounts as part of
+the rotation runbook, which is a separate decision. Until then `test-resources.bicep` must stay.
+
+Legs without an `AccountSelector` skip the resolver step (see the `condition` in
+`resolve-test-account-steps.yml`).
+
+## Running the tests locally
+
+```powershell
+pwsh ./sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
+```
+
+No Pester, no modules — plain `pwsh`, matching the zero-dependency posture of the resolver itself.
+
+To see what the resolver would export without ADO logging commands:
+
+```powershell
+./sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1 `
+  -AccountsJson (Get-Content accounts.json -Raw) `
+  -Selector single-session `
+  -Local
+```
+
+## Rotating the secret
+
+1. Recreate/refresh the accounts with Java's `New-CosmosLiveTestAccounts.ps1`.
+2. Regenerate the accounts JSON (schema: Java's `live-test-accounts.schema.json`, `version: 1`).
+3. Update `sub-config-cosmos-azure-cloud-test-resources` in the
+   `Test Secrets for Cosmos Live Tests - user administered` variable group.
+4. Re-run one leg as a smoke test.
+
+No repo change is required, in either language.
diff --git a/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1 b/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
new file mode 100644
index 000000000000..d14dd78e037d
--- /dev/null
+++ b/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
@@ -0,0 +1,180 @@
+#!/usr/bin/env pwsh
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+<#
+.SYNOPSIS
+    Resolves a single fixed Cosmos live-test account from the one JSON secret and exports
+    ACCOUNT_HOST / ACCOUNT_KEY (and optional SECONDARY_ACCOUNT_KEY) for the test run.
+
+.DESCRIPTION
+    This is the PowerShell counterpart of the Java repo's sdk/cosmos/pipeline/resolve-cosmos-test-account.sh
+    and reads the exact same secret, in the same schema, with the same validation rules.
+
+    It is PowerShell rather than bash+jq on purpose: unlike Java, the Python Cosmos live matrix
+    (sdk/cosmos/live-platform-matrix.json) runs legs on windows-2022 and macos images as well as
+    Linux, and neither bash nor jq can be relied on there. `pwsh` is present on all three hosted
+    images and ConvertFrom-Json removes the jq dependency entirely.
+
+    Only ACCOUNT_HOST / ACCOUNT_KEY (+ optional SECONDARY_ACCOUNT_KEY) are emitted. Account
+    consistency, preferred locations and AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER are deliberately NOT
+    emitted here: those are per-leg concerns owned by live-platform-matrix.json, and emitting them
+    would clobber the matrix values.
+
+.PARAMETER AccountsJson
+    Raw JSON matching live-test-accounts.schema.json (the value of the
+    sub-config-cosmos-azure-cloud-test-resources variable). Defaults to $env:COSMOS_TEST_ACCOUNTS_JSON.
+
+.PARAMETER Selector
+    Logical account name to select, e.g. multimaster-multiregion-session.
+    Defaults to $env:COSMOS_ACCOUNT_SELECTOR.
+
+.PARAMETER Local
+    Print NAME=VALUE to stdout instead of emitting Azure DevOps ##vso logging commands.
+    Used by the tests and for local troubleshooting. Also honours
+    $env:COSMOS_ACCOUNTS_LOCAL -eq 'true'.
+
+.OUTPUTS
+    Azure DevOps logging commands on stdout (or NAME=VALUE lines under -Local).
+
+.NOTES
+    Exit codes: 0 on success, 1 on any validation failure.
+#>
+[CmdletBinding()]
+param(
+    [string] $AccountsJson = $env:COSMOS_TEST_ACCOUNTS_JSON,
+    [string] $Selector = $env:COSMOS_ACCOUNT_SELECTOR,
+    [switch] $Local
+)
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+if (-not $Local -and $env:COSMOS_ACCOUNTS_LOCAL -eq 'true') {
+    $Local = [switch]::Present
+}
+
+function Write-Failure {
+    param([string] $Message)
+    Write-Error "ERROR: $Message" -ErrorAction Continue
+    exit 1
+}
+
+# Azure DevOps logging commands are line-oriented, so a value containing a newline would
+# truncate the variable and spill the remainder into the log as plain text. For a key that
+# would mean leaking secret material past the scrubber, so reject it outright.
+function Assert-SingleLine {
+    param([string] $Name, [string] $Value)
+    if ($Value -match '[\r\n]') {
+        Write-Failure "Account '$Selector' field '$Name' contains a line break, which cannot be safely exported as a pipeline variable."
+    }
+}
+
+function Write-PublicVariable {
+    param([string] $Name, [string] $Value)
+    if ($Local) {
+        Write-Output "$Name=$Value"
+    }
+    else {
+        Write-Host "##vso[task.setvariable variable=$Name;issecret=false]$Value"
+    }
+}
+
+# Emit a secret using the azure-sdk double-set convention (the same one
+# eng/common/TestResources/TestResources-Helpers.ps1 uses when it publishes ARM outputs):
+# register the literal value as a secret under _NAME so the log scrubber masks it
+# everywhere, AND set a plain NAME so it still auto-exports as an environment variable to
+# the test task. Marking a variable issecret=true alone would suppress that propagation and
+# the tests would see no key at all.
+function Write-SecretVariable {
+    param([string] $Name, [string] $Value)
+    if ($Local) {
+        Write-Output "$Name=$Value"
+    }
+    else {
+        Write-Host "##vso[task.setvariable variable=_$Name;issecret=true]$Value"
+        Write-Host "##vso[task.setvariable variable=$Name;issecret=false]$Value"
+    }
+}
+
+if ([string]::IsNullOrWhiteSpace($AccountsJson)) {
+    Write-Failure "Accounts JSON is empty. Wire the sub-config-cosmos-azure-cloud-test-resources secret to COSMOS_TEST_ACCOUNTS_JSON."
+}
+if ([string]::IsNullOrWhiteSpace($Selector)) {
+    Write-Failure "Account selector is empty. Set COSMOS_ACCOUNT_SELECTOR to a logical account name."
+}
+
+try {
+    $config = $AccountsJson | ConvertFrom-Json
+}
+catch {
+    Write-Failure "Accounts JSON is not valid JSON: $($_.Exception.Message)"
+}
+
+if ($null -eq $config -or $config -isnot [psobject]) {
+    Write-Failure "Accounts JSON must be a JSON object."
+}
+
+$configProperties = @($config.PSObject.Properties.Name)
+
+$version = if ($configProperties -contains 'version') { $config.version } else { $null }
+if ("$version" -ne '1') {
+    Write-Failure "Unsupported or missing schema version '$version' (parser supports: 1)."
+}
+
+if ($configProperties -notcontains 'accounts' -or $null -eq $config.accounts) {
+    Write-Failure "Accounts JSON has no 'accounts' object."
+}
+
+# Match the selector case-sensitively, like the jq `has()` the Java resolver uses, so a leg
+# never silently binds to a different account than the one its matrix entry names.
+$accountProperty = @($config.accounts.PSObject.Properties | Where-Object { $_.Name -ceq $Selector })
+if ($accountProperty.Count -ne 1) {
+    $available = ($config.accounts.PSObject.Properties.Name | Sort-Object) -join ', '
+    if ([string]::IsNullOrWhiteSpace($available)) { $available = '<none>' }
+    Write-Failure "Account selector '$Selector' not found. Available: $available"
+}
+
+$account = $accountProperty[0].Value
+if ($null -eq $account -or $account -isnot [psobject]) {
+    Write-Failure "Account '$Selector' is not an object."
+}
+
+$accountProperties = @($account.PSObject.Properties.Name)
+function Get-AccountField {
+    param([string] $Name)
+    if ($accountProperties -contains $Name) {
+        $value = $account.$Name
+        if ($value -is [string]) { return $value }
+        if ($null -ne $value) { return "$value" }
+    }
+    return ''
+}
+
+$endpoint = Get-AccountField 'endpoint'
+$key = Get-AccountField 'key'
+$secondaryKey = Get-AccountField 'secondaryKey'
+
+if ([string]::IsNullOrWhiteSpace($endpoint)) {
+    Write-Failure "Account '$Selector' is missing required 'endpoint'."
+}
+if ([string]::IsNullOrWhiteSpace($key)) {
+    Write-Failure "Account '$Selector' is missing required 'key'."
+}
+if (-not $endpoint.StartsWith('https://', [System.StringComparison]::Ordinal)) {
+    Write-Failure "Account '$Selector' endpoint must start with https:// (got '$endpoint')."
+}
+
+Assert-SingleLine 'endpoint' $endpoint
+Assert-SingleLine 'key' $key
+
+Write-PublicVariable 'ACCOUNT_HOST' $endpoint
+Write-SecretVariable 'ACCOUNT_KEY' $key
+if (-not [string]::IsNullOrWhiteSpace($secondaryKey)) {
+    Assert-SingleLine 'secondaryKey' $secondaryKey
+    Write-SecretVariable 'SECONDARY_ACCOUNT_KEY' $secondaryKey
+}
+
+# Masked, secret-free summary for the build log.
+Write-Host "Resolved Cosmos test account '$Selector': endpoint=$endpoint key=***"
+exit 0
diff --git a/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1 b/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
new file mode 100644
index 000000000000..4006c814f443
--- /dev/null
+++ b/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
@@ -0,0 +1,249 @@
+#!/usr/bin/env pwsh
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+<#
+.SYNOPSIS
+    Tests for resolve-cosmos-test-account.ps1.
+
+.DESCRIPTION
+    Port of the Java repo's resolve-cosmos-test-account.tests.sh, covering the same cases plus
+    two Python-specific ones (see "circuit breaker" and "line break" below).
+
+    Deliberately plain PowerShell rather than Pester so it runs anywhere pwsh does with no
+    module install, matching the zero-dependency posture of the resolver itself.
+
+.EXAMPLE
+    pwsh ./resolve-cosmos-test-account.tests.ps1
+#>
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+$script:Resolver = Join-Path $PSScriptRoot 'resolve-cosmos-test-account.ps1'
+$script:Failures = 0
+$script:Total = 0
+
+$script:ValidJson = @'
+{
+  "version": 1,
+  "accounts": {
+    "single-session": {
+      "endpoint": "https://sdkci-single-session.documents.azure.com:443/",
+      "key": "primary-key-single",
+      "regions": ["Central US"],
+      "consistency": "Session",
+      "multiWrite": false
+    },
+    "multimaster-multiregion-session": {
+      "endpoint": "https://sdkci-multimaster-multiregion-session.documents.azure.com:443/",
+      "key": "primary-key-mm",
+      "secondaryKey": "secondary-key-mm",
+      "regions": ["Central US", "East US 2"],
+      "consistency": "Session",
+      "multiWrite": true
+    }
+  }
+}
+'@
+
+function Invoke-Resolver {
+    param([string] $Json, [string] $Selector)
+
+    $stderrFile = [System.IO.Path]::GetTempFileName()
+    try {
+        $arguments = @(
+            '-NoLogo', '-NoProfile', '-NonInteractive',
+            '-File', $script:Resolver,
+            '-AccountsJson', $Json,
+            '-Selector', $Selector,
+            '-Local'
+        )
+        $stdout = & pwsh @arguments 2>$stderrFile
+        return [pscustomobject]@{
+            ExitCode = $LASTEXITCODE
+            StdOut   = ($stdout | Out-String)
+            StdErr   = (Get-Content -Path $stderrFile -Raw -ErrorAction SilentlyContinue)
+        }
+    }
+    finally {
+        Remove-Item -Path $stderrFile -Force -ErrorAction SilentlyContinue
+    }
+}
+
+function Test-Case {
+    param([string] $Name, [scriptblock] $Body)
+
+    $script:Total++
+    try {
+        & $Body
+        Write-Host "  PASS  $Name"
+    }
+    catch {
+        $script:Failures++
+        Write-Host "  FAIL  $Name"
+        Write-Host "        $($_.Exception.Message)"
+    }
+}
+
+function Assert-True {
+    param([bool] $Condition, [string] $Message)
+    if (-not $Condition) { throw $Message }
+}
+
+Write-Host "resolve-cosmos-test-account.ps1"
+
+Test-Case 'resolves endpoint and key for a valid selector' {
+    $r = Invoke-Resolver -Json $script:ValidJson -Selector 'single-session'
+    Assert-True ($r.ExitCode -eq 0) "expected exit 0, got $($r.ExitCode): $($r.StdErr)"
+    Assert-True ($r.StdOut -match 'ACCOUNT_HOST=https://sdkci-single-session\.documents\.azure\.com:443/') 'ACCOUNT_HOST not emitted'
+    Assert-True ($r.StdOut -match 'ACCOUNT_KEY=primary-key-single') 'ACCOUNT_KEY not emitted'
+}
+
+Test-Case 'emits SECONDARY_ACCOUNT_KEY only when the account defines one' {
+    $withSecondary = Invoke-Resolver -Json $script:ValidJson -Selector 'multimaster-multiregion-session'
+    Assert-True ($withSecondary.StdOut -match 'SECONDARY_ACCOUNT_KEY=secondary-key-mm') 'SECONDARY_ACCOUNT_KEY not emitted when present'
+
+    $withoutSecondary = Invoke-Resolver -Json $script:ValidJson -Selector 'single-session'
+    Assert-True ($withoutSecondary.StdOut -notmatch 'SECONDARY_ACCOUNT_KEY') 'SECONDARY_ACCOUNT_KEY emitted when absent'
+}
+
+# Python-specific: the circuit breaker flag is a client-side SDK setting owned by
+# live-platform-matrix.json, not an account property. If the resolver ever emitted it, it would
+# clobber the per-leg value and silently change what the circuit-breaker lane actually tests.
+Test-Case 'does not emit matrix-owned settings (circuit breaker, consistency, preferred locations)' {
+    $r = Invoke-Resolver -Json $script:ValidJson -Selector 'multimaster-multiregion-session'
+    Assert-True ($r.StdOut -notmatch 'AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER') 'circuit breaker flag must stay matrix-controlled'
+    Assert-True ($r.StdOut -notmatch 'ACCOUNT_CONSISTENCY') 'consistency must stay matrix-controlled'
+    Assert-True ($r.StdOut -notmatch 'PREFERRED_LOCATIONS') 'preferred locations must stay matrix-controlled'
+}
+
+Test-Case 'fails when the accounts JSON is empty' {
+    $r = Invoke-Resolver -Json '' -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'is empty') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'fails when the selector is empty' {
+    $r = Invoke-Resolver -Json $script:ValidJson -Selector ''
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'selector is empty') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'fails when the accounts JSON is not valid JSON' {
+    $r = Invoke-Resolver -Json 'not json at all' -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'not valid JSON') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'rejects an unsupported schema version' {
+    $json = '{"version": 2, "accounts": {"single-session": {"endpoint": "https://x.documents.azure.com:443/", "key": "k"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'Unsupported or missing schema version') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'rejects a missing schema version' {
+    $json = '{"accounts": {"single-session": {"endpoint": "https://x.documents.azure.com:443/", "key": "k"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'Unsupported or missing schema version') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'lists the available selectors when the requested one is missing' {
+    $r = Invoke-Resolver -Json $script:ValidJson -Selector 'does-not-exist'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match "Account selector 'does-not-exist' not found") "unexpected error: $($r.StdErr)"
+    Assert-True ($r.StdErr -match 'single-session') 'error should list the available selectors'
+}
+
+# A case-insensitive match would let a matrix typo silently bind a leg to the wrong account,
+# which is exactly the class of bug this whole design is meant to make impossible.
+Test-Case 'selector matching is case-sensitive' {
+    $r = Invoke-Resolver -Json $script:ValidJson -Selector 'Single-Session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit for a case mismatch'
+    Assert-True ($r.StdErr -match 'not found') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'requires endpoint' {
+    $json = '{"version": 1, "accounts": {"single-session": {"key": "k"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match "missing required 'endpoint'") "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'requires key' {
+    $json = '{"version": 1, "accounts": {"single-session": {"endpoint": "https://x.documents.azure.com:443/"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match "missing required 'key'") "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'requires an https endpoint' {
+    $json = '{"version": 1, "accounts": {"single-session": {"endpoint": "http://x.documents.azure.com:443/", "key": "k"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'must start with https://') "unexpected error: $($r.StdErr)"
+}
+
+# Azure DevOps logging commands are line-oriented, so a newline in a key would truncate the
+# variable and print the remainder of the secret to the log as unscrubbed plain text.
+Test-Case 'rejects a key containing a line break' {
+    $json = '{"version": 1, "accounts": {"single-session": {"endpoint": "https://x.documents.azure.com:443/", "key": "line1\nline2"}}}'
+    $r = Invoke-Resolver -Json $json -Selector 'single-session'
+    Assert-True ($r.ExitCode -ne 0) 'expected non-zero exit'
+    Assert-True ($r.StdErr -match 'line break') "unexpected error: $($r.StdErr)"
+}
+
+Test-Case 'emits ADO logging commands, using the double-set convention for secrets' {
+    $stderrFile = [System.IO.Path]::GetTempFileName()
+    try {
+        $arguments = @(
+            '-NoLogo', '-NoProfile', '-NonInteractive',
+            '-File', $script:Resolver,
+            '-AccountsJson', $script:ValidJson,
+            '-Selector', 'multimaster-multiregion-session'
+        )
+        $stdout = (& pwsh @arguments 2>$stderrFile | Out-String)
+        Assert-True ($LASTEXITCODE -eq 0) "expected exit 0, got $LASTEXITCODE"
+        Assert-True ($stdout -match '\#\#vso\[task\.setvariable variable=ACCOUNT_HOST;issecret=false\]') 'ACCOUNT_HOST must be public'
+        Assert-True ($stdout -match '\#\#vso\[task\.setvariable variable=_ACCOUNT_KEY;issecret=true\]') 'ACCOUNT_KEY must be registered with the log scrubber'
+        Assert-True ($stdout -match '\#\#vso\[task\.setvariable variable=ACCOUNT_KEY;issecret=false\]') 'ACCOUNT_KEY must also be set plainly so it reaches the test task env'
+        Assert-True ($stdout -notmatch 'key=primary-key-mm') 'the summary line must not echo the key'
+    }
+    finally {
+        Remove-Item -Path $stderrFile -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Test-Case 'reads its inputs from the environment when parameters are omitted' {
+    $stderrFile = [System.IO.Path]::GetTempFileName()
+    try {
+        $previousJson = $env:COSMOS_TEST_ACCOUNTS_JSON
+        $previousSelector = $env:COSMOS_ACCOUNT_SELECTOR
+        $previousLocal = $env:COSMOS_ACCOUNTS_LOCAL
+        $env:COSMOS_TEST_ACCOUNTS_JSON = $script:ValidJson
+        $env:COSMOS_ACCOUNT_SELECTOR = 'single-session'
+        $env:COSMOS_ACCOUNTS_LOCAL = 'true'
+
+        $stdout = (& pwsh -NoLogo -NoProfile -NonInteractive -File $script:Resolver 2>$stderrFile | Out-String)
+        Assert-True ($LASTEXITCODE -eq 0) "expected exit 0, got $LASTEXITCODE"
+        Assert-True ($stdout -match 'ACCOUNT_KEY=primary-key-single') 'env-provided inputs were not used'
+    }
+    finally {
+        $env:COSMOS_TEST_ACCOUNTS_JSON = $previousJson
+        $env:COSMOS_ACCOUNT_SELECTOR = $previousSelector
+        $env:COSMOS_ACCOUNTS_LOCAL = $previousLocal
+        Remove-Item -Path $stderrFile -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Write-Host ''
+if ($script:Failures -gt 0) {
+    Write-Host "$($script:Total - $script:Failures)/$($script:Total) passed, $($script:Failures) failed"
+    exit 1
+}
+Write-Host "$($script:Total)/$($script:Total) passed"
+exit 0
diff --git a/sdk/cosmos/pipeline/resolve-test-account-steps.yml b/sdk/cosmos/pipeline/resolve-test-account-steps.yml
new file mode 100644
index 000000000000..65421238ff2a
--- /dev/null
+++ b/sdk/cosmos/pipeline/resolve-test-account-steps.yml
@@ -0,0 +1,35 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#
+# Reusable pre-test step that resolves one fixed Cosmos live-test account from the single JSON
+# secret and exports ACCOUNT_HOST / ACCOUNT_KEY (+ optional SECONDARY_ACCOUNT_KEY) for the test
+# run. Drop this into a stage's BeforeTestSteps, alongside DisableAzureResourceCreation: true.
+#
+# The account JSON lives in the ADO variable group secret referenced by AccountsJsonVar. That
+# variable group must be listed in the pipeline's VariableGroups, otherwise $(<AccountsJsonVar>)
+# expands to the literal macro text and the resolver fails with "not valid JSON".
+#
+# AccountSelector picks which logical account to use. It is normally the macro $(AccountSelector),
+# resolved per matrix leg from live-platform-matrix.json, but may also be a literal for a
+# single-account stage.
+#
+# Port of azure-sdk-for-java's sdk/cosmos/pipeline/resolve-test-account-steps.yml. The Java version
+# invokes a bash script because all of its Cosmos legs run on Linux; ours has to work on the
+# windows-2022 and macOS legs too, so it calls PowerShell instead.
+parameters:
+  - name: AccountSelector
+    type: string
+  - name: AccountsJsonVar
+    type: string
+    default: 'sub-config-cosmos-azure-cloud-test-resources'
+
+steps:
+  - pwsh: |
+      ./sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
+    displayName: 'Resolve fixed Cosmos test account (${{ parameters.AccountSelector }})'
+    # Legs that still provision their own account (the AAD lanes, which need a per-tenant
+    # sqlRoleAssignment) do not set AccountSelector. Skip rather than fail for them.
+    condition: and(succeeded(), ne(variables['AccountSelector'], ''))
+    env:
+      COSMOS_TEST_ACCOUNTS_JSON: $(${{ parameters.AccountsJsonVar }})
+      COSMOS_ACCOUNT_SELECTOR: ${{ parameters.AccountSelector }}

From b04fb253335a9ecbaae178bc9e1c29512bcfbe2c Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:55:21 -0400
Subject: [PATCH 5/7] [cosmos] Point the key-auth live-test legs at the fixed
 accounts

Adds AccountSelector to the 12 key-auth matrix legs and runs the resolver from
BeforeTestSteps. The resolver executes after the ARM deployment and republishes
ACCOUNT_HOST/ACCOUNT_KEY, so those legs talk to the fixed sdkci-* accounts while everything
else about the pipeline stays as it is.

Provisioning is deliberately left on. Turning it off is what removes the tenant coupling, but
DisableAzureResourceCreation is a stage-level parameter and the AAD legs share the stage --
they need the per-tenant sqlRoleAssignment that test-resources.bicep creates, so they cannot
stop provisioning. Overriding rather than disabling proves the accounts, the secret and the
resolver end to end without forcing that split first. The AAD legs set no AccountSelector, so
the resolver step skips itself for them and they keep the account they provisioned.

Selector map (verified against the matrix, not the group names -- several groups expand to
two or three jobs):

  single-session                   cosmosQuery, cosmosSearchQuery, cosmosLong x2
  single-session-split             cosmosSplit x2
  multiregion-tc-session           cosmosCircuitBreakerMultiRegion,
                                   cosmosPerPartitionAutomaticFailover
  multimaster-multiregion-session  cosmosCircuitBreaker, cosmosMultiRegion x3

The circuit-breaker and per-partition-failover lanes need no dedicated account: failures are
injected in-process by tests/_fault_injection_transport.py rather than by degrading the real
account, so they only need the right topology.

Selector values are mapped to "" in displayNames so they do not lengthen job names.

Two things to watch on the first run. The variable group must actually expose
sub-config-cosmos-azure-cloud-test-resources -- if it does not, $(...) expands to its own
literal macro text and the resolver reports "not valid JSON". And both cosmosSplit jobs share
one selector and run concurrently, each forcing splits and scaling to 30000 RU; that is
container-scoped so correctness holds, but it is real load on a shared account.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 sdk/cosmos/live-platform-matrix.json | 42 ++++++++++++++-------
 sdk/cosmos/pipeline/README.md        | 55 ++++++++++++++++++++++------
 sdk/cosmos/tests.yml                 | 12 ++++++
 3 files changed, 84 insertions(+), 25 deletions(-)

diff --git a/sdk/cosmos/live-platform-matrix.json b/sdk/cosmos/live-platform-matrix.json
index d363e4ee4549..b99fe6c0107d 100644
--- a/sdk/cosmos/live-platform-matrix.json
+++ b/sdk/cosmos/live-platform-matrix.json
@@ -2,7 +2,11 @@
   "displayNames": {
     "--disablecov": "",
     "false": "",
-    "true": ""
+    "true": "",
+    "single-session": "",
+    "single-session-split": "",
+    "multiregion-tc-session": "",
+    "multimaster-multiregion-session": ""
   },
   "include": [
     {
@@ -13,7 +17,8 @@
           "PythonVersion": "3.14",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosSplit"
+          "TestMarkArgument": "cosmosSplit",
+          "AccountSelector": "single-session-split"
         },
         "Ubuntu2404_313_split": {
           "OSVmImage": "env:LINUXVMIMAGE",
@@ -21,7 +26,8 @@
           "PythonVersion": "3.13",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosSplit"
+          "TestMarkArgument": "cosmosSplit",
+          "AccountSelector": "single-session-split"
         }
       }
     },
@@ -33,7 +39,8 @@
           "PythonVersion": "3.13",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosCircuitBreaker"
+          "TestMarkArgument": "cosmosCircuitBreaker",
+          "AccountSelector": "multimaster-multiregion-session"
         }
       },
       "ArmConfig": {
@@ -50,7 +57,8 @@
           "PythonVersion": "3.10",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosCircuitBreakerMultiRegion"
+          "TestMarkArgument": "cosmosCircuitBreakerMultiRegion",
+          "AccountSelector": "multiregion-tc-session"
         }
       },
       "ArmConfig": {
@@ -67,7 +75,8 @@
           "PythonVersion": "3.13",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosPerPartitionAutomaticFailover"
+          "TestMarkArgument": "cosmosPerPartitionAutomaticFailover",
+          "AccountSelector": "multiregion-tc-session"
         }
       },
       "ArmConfig": {
@@ -84,7 +93,8 @@
           "PythonVersion": "3.11",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosSearchQuery"
+          "TestMarkArgument": "cosmosSearchQuery",
+          "AccountSelector": "single-session"
         }
       }
     },
@@ -96,7 +106,8 @@
           "PythonVersion": "3.10",
           "CoverageArg": "",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosQuery"
+          "TestMarkArgument": "cosmosQuery",
+          "AccountSelector": "single-session"
         }
       }
     },
@@ -211,7 +222,8 @@
           "PythonVersion": "3.10",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosLong"
+          "TestMarkArgument": "cosmosLong",
+          "AccountSelector": "single-session"
         },
         "Windows2022_312_long": {
           "OSVmImage": "env:WINDOWSVMIMAGE",
@@ -219,7 +231,8 @@
           "PythonVersion": "3.12",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosLong"
+          "TestMarkArgument": "cosmosLong",
+          "AccountSelector": "single-session"
         }
       }
     },
@@ -231,7 +244,8 @@
           "PythonVersion": "3.14",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosMultiRegion"
+          "TestMarkArgument": "cosmosMultiRegion",
+          "AccountSelector": "multimaster-multiregion-session"
         },
         "Windows2022_310": {
           "OSVmImage": "env:WINDOWSVMIMAGE",
@@ -239,7 +253,8 @@
           "PythonVersion": "3.10",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosMultiRegion"
+          "TestMarkArgument": "cosmosMultiRegion",
+          "AccountSelector": "multimaster-multiregion-session"
         },
         "Windows2022_312": {
           "OSVmImage": "env:WINDOWSVMIMAGE",
@@ -247,7 +262,8 @@
           "PythonVersion": "3.12",
           "CoverageArg": "--disablecov",
           "TestSamples": "false",
-          "TestMarkArgument": "cosmosMultiRegion"
+          "TestMarkArgument": "cosmosMultiRegion",
+          "AccountSelector": "multimaster-multiregion-session"
         }
       },
       "ArmConfig": {
diff --git a/sdk/cosmos/pipeline/README.md b/sdk/cosmos/pipeline/README.md
index 2f883b2dd946..70b768d77400 100644
--- a/sdk/cosmos/pipeline/README.md
+++ b/sdk/cosmos/pipeline/README.md
@@ -35,6 +35,9 @@ it here** — Python consumes the same accounts and the same JSON.
 | `multiregion-tc-session` | 2 regions, Session, **single**-write | `cosmosCircuitBreakerMultiRegion`, `cosmosPerPartitionAutomaticFailover` |
 | `multimaster-multiregion-session` | 2 regions, Session, multi-write | `cosmosMultiRegion` (×3), `cosmosCircuitBreaker` |
 
+That is 12 of the 20 matrix jobs. The other 8 are the 7 `cosmosAAD*` legs (see below) and `cosmosGSI`,
+which already has its own fixed account via `$(gsi-pipeline-uri)`/`$(gsi-pipeline-key)`.
+
 Python needs far fewer accounts than Java's 18 because it does not vary account consistency per leg
 and has no thin-client / HTTP-2 / pmerge / Kafka lanes.
 
@@ -50,14 +53,37 @@ from `client.get_database_account()` at runtime, and no live test pins a region
 
 ## How a run binds to an account
 
-1. `sdk/cosmos/tests.yml` sets `DisableAzureResourceCreation: true`, so
-   `eng/pipelines/templates/jobs/live.tests.yml` skips both the ARM deployment and its teardown.
-2. Each matrix leg in `live-platform-matrix.json` sets `AccountSelector`.
+Rollout is staged. Today:
+
+1. Each key-auth leg in `live-platform-matrix.json` sets `AccountSelector`. AAD legs deliberately do not.
+2. The pipeline still provisions an account per run, as before.
 3. `resolve-test-account-steps.yml` runs in `BeforeTestSteps`, which
-   `eng/pipelines/templates/steps/build-test.yml` executes in the same job immediately before the
-   pytest task — so pipeline variables it publishes reach the tests as environment variables.
-4. `resolve-cosmos-test-account.ps1` reads the JSON secret, looks up the selector and publishes
-   `ACCOUNT_HOST` / `ACCOUNT_KEY`, which `tests/test_config.py` already consumes. No test-side change.
+   `eng/pipelines/templates/steps/build-test.yml` executes in the same job **after** the ARM deployment
+   and immediately before the pytest task.
+4. `resolve-cosmos-test-account.ps1` reads the JSON secret, looks up the selector and republishes
+   `ACCOUNT_HOST` / `ACCOUNT_KEY`, **overwriting** the values the deployment just set. `tests/test_config.py`
+   already reads exactly those two names, so no test-side change is needed. Legs with no selector skip
+   the step entirely and keep the account they provisioned.
+
+This proves the accounts, the secret and the resolver end to end while leaving the AAD lane untouched.
+It does not yet make the key legs survive a tenant rotation, because the deployment still runs.
+
+Next, once that is green: set `DisableAzureResourceCreation: true` so
+`eng/pipelines/templates/jobs/live.tests.yml` skips both the deployment and its teardown. That is the
+change that actually removes the tenant coupling. It is a stage-level parameter and the AAD legs share
+the stage, so it needs one of:
+
+- **Split the pipeline** — a second `tests-aad.yml` with its own matrix, keeping the AAD legs on
+  provisioning. Fully repo-local; costs one new ADO pipeline registration.
+- **Move AAD onto the fixed accounts** — assign the data-plane role to the current tenant's test
+  principal on the `sdk-ci` accounts as part of the rotation runbook. Keeps one pipeline and makes the
+  AAD lane rotation-proof too, but needs `azure-sdk-tests-cosmos` granted rights to write
+  `sqlRoleAssignments` on the `sdk-ci` resource group.
+- **A per-leg runtime gate** — add a `Condition` parameter to
+  `eng/common/TestResources/{deploy,remove}-test-resources.yml`. Generic and useful to other repos, but
+  it is an azure-sdk-tools change with a sync lag.
+
+`DisableAzureResourceCreation` already exists and defaults to `false`, so the plumbing is in place.
 
 ### Why PowerShell and not Java's bash + jq
 
@@ -90,12 +116,17 @@ this.
 
 The `cosmosAAD*` legs are **not** on fixed accounts. `test-resources.bicep` creates a custom
 `sqlRoleDefinition` plus a `sqlRoleAssignment` for `testApplicationOid`, and that principal is
-tenant-scoped — it changes on every rotation. Moving those legs onto the fixed accounts requires
-granting the test service principal a data-plane role assignment on the `sdk-ci` accounts as part of
-the rotation runbook, which is a separate decision. Until then `test-resources.bicep` must stay.
+tenant-scoped — it changes on every rotation. So `test-resources.bicep` must stay, and those legs set
+no `AccountSelector`, which makes `resolve-test-account-steps.yml` skip itself for them (see its
+`condition`).
+
+Because the resolver only overrides `ACCOUNT_HOST`/`ACCOUNT_KEY` for legs that name a selector, the
+key-auth and AAD lanes coexist in one stage today with no interference.
 
-Legs without an `AccountSelector` skip the resolver step (see the `condition` in
-`resolve-test-account-steps.yml`).
+Note also that `AZURE_COSMOS_ENABLE_CIRCUIT_BREAKER` still arrives as a bicep output while provisioning
+is on. When provisioning is switched off it has to move to a per-leg matrix env var — it is a
+client-side SDK setting (`azure/cosmos/_constants.py`), not an account property, and the bicep only
+echoes the parameter straight back out.
 
 ## Running the tests locally
 
diff --git a/sdk/cosmos/tests.yml b/sdk/cosmos/tests.yml
index e9cb621e8a2f..bbe00150d820 100644
--- a/sdk/cosmos/tests.yml
+++ b/sdk/cosmos/tests.yml
@@ -18,6 +18,18 @@ extends:
       ServiceDirectory: cosmos
       VariableGroups:
         - 'Test Secrets for Cosmos Live Tests - user administered'
+      # Key-auth legs bind to fixed, Cosmos-team-owned accounts (RG sdk-ci) instead of the
+      # account this pipeline provisions. The resolver runs after the ARM deployment and
+      # overwrites ACCOUNT_HOST/ACCOUNT_KEY, so the AAD legs -- which need the per-tenant
+      # sqlRoleAssignment that test-resources.bicep creates, and set no AccountSelector --
+      # keep using the provisioned account untouched.
+      # Provisioning stays on for now; turning it off for the key legs is the follow-up that
+      # actually makes them survive the ~90-day tenant rotation.
+      # See sdk/cosmos/pipeline/README.md.
+      BeforeTestSteps:
+        - template: /sdk/cosmos/pipeline/resolve-test-account-steps.yml
+          parameters:
+            AccountSelector: $(AccountSelector)
       EnvVars:
         GSI_ACCOUNT_HOST: $(gsi-pipeline-uri)
         GSI_ACCOUNT_KEY: $(gsi-pipeline-key)

From 8829fc3f7d3be7f796e39b05eeb4057ce86d3c82 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Wed, 5 Aug 2026 17:08:14 -0400
Subject: [PATCH 6/7] [cosmos] Fix failures exposed by fixed live accounts

Route AAD-credential regression tests to the AAD lane, and give
availability-strategy hedging enough timing margin for shared accounts.
Also register the resolver vocabulary with cspell.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 .../tests/test_aad_inference_service_lazy_init.py  |  2 +-
 .../test_aad_inference_service_lazy_init_async.py  |  2 +-
 .../tests/test_availability_strategy.py            | 14 +++++++++-----
 .../tests/test_availability_strategy_async.py      | 13 ++++++++-----
 sdk/cosmos/pipeline/README.md                      |  2 ++
 .../pipeline/resolve-cosmos-test-account.ps1       |  1 +
 .../pipeline/resolve-cosmos-test-account.tests.ps1 |  1 +
 7 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init.py b/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init.py
index d20316af6c82..26a376d9494a 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init.py
@@ -67,7 +67,7 @@ def get_token(self, *scopes, **kwargs):
 
 
 @pytest.mark.cosmosEmulator
-@pytest.mark.cosmosLong
+@pytest.mark.cosmosAADLong
 class TestAADInferenceServiceLazyInit(unittest.TestCase):
     """Verify AAD client construction succeeds without the semantic reranker env var.
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init_async.py b/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init_async.py
index 95d9b2a285b1..f94b28c0511c 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_aad_inference_service_lazy_init_async.py
@@ -66,7 +66,7 @@ async def get_token(self, *scopes, **kwargs):
 
 
 @pytest.mark.cosmosEmulator
-@pytest.mark.cosmosLong
+@pytest.mark.cosmosAADLong
 class TestAADInferenceServiceLazyInitAsync(unittest.IsolatedAsyncioTestCase):
     """Verify async AAD client construction succeeds without the semantic reranker env var.
 
diff --git a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
index 0937c1726956..bbe3d1223899 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy.py
@@ -55,6 +55,9 @@ def _select_primary_and_failover_region(write_locations, read_locations):
 READ_ALL = "read_all"
 CHANGE_FEED = "change_feed"
 
+STEADY_STATE_HEDGING_THRESHOLD_MS = 5000
+FAULT_INJECTION_DELAY_MS = 5000
+
 # Non-transient status codes
 NON_TRANSIENT_STATUS_CODES = [
     (400, None),
@@ -354,9 +357,10 @@ def test_invalid_thresholds(self, threshold_ms, threshold_steps_ms, error_messag
 
     @pytest.mark.parametrize("operation", [READ, QUERY, QUERY_PK, READ_ALL, CHANGE_FEED, CREATE, UPSERT, REPLACE, DELETE, PATCH, BATCH])
     @pytest.mark.parametrize("client_availability_strategy, request_availability_strategy", [
-        (None, {'threshold_ms':150,  'threshold_steps_ms':50}),
-        ({'threshold_ms':150, 'threshold_steps_ms':50}, None),
-        ({'threshold_ms':150, 'threshold_steps_ms':50}, {'threshold_ms':150, 'threshold_steps_ms':50})
+        (None, {'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50}),
+        ({'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50}, None),
+        ({'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50},
+         {'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50})
     ])
     def test_availability_strategy_in_steady_state(
             self,
@@ -413,7 +417,7 @@ def test_client_availability_strategy_failover(
                                FaultInjectionTransport.predicate_targets_region(r, uri_down))
 
         error_lambda = lambda r: FaultInjectionTransport.error_after_delay(
-            1000,  # Add delay to trigger hedging
+            FAULT_INJECTION_DELAY_MS,
             CosmosHttpResponseError(status_code=400, message="Injected Error")
         )
         custom_transport = self._get_custom_transport_with_fault_injection(predicate, error_lambda)
@@ -597,7 +601,7 @@ def test_request_level_enable_override_client_disable(self, operation):
                                FaultInjectionTransport.predicate_targets_region(r, uri_down))
 
         error_lambda = lambda r: FaultInjectionTransport.error_after_delay(
-            700,  # Add delay to trigger hedging
+            FAULT_INJECTION_DELAY_MS,
             CosmosHttpResponseError(status_code=400, message="Injected Error")
             # using non retryable errors to verify the request will only go to the first region
         )
diff --git a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
index 358d222365bd..7fe9f10f90a4 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_availability_strategy_async.py
@@ -92,6 +92,9 @@ async def setup():
 READ_ALL = "read_all"
 CHANGE_FEED = "change_feed"
 
+STEADY_STATE_HEDGING_THRESHOLD_MS = 5000
+FAULT_INJECTION_DELAY_MS = 5000
+
 # Non-transient status codes
 NON_TRANSIENT_STATUS_CODES = [
     (400, None),
@@ -378,10 +381,10 @@ def test_invalid_thresholds_async(self, threshold_ms, threshold_steps_ms, error_
     @pytest.mark.asyncio
     @pytest.mark.parametrize("operation", [READ, QUERY, QUERY_PK, READ_ALL, CHANGE_FEED, CREATE, UPSERT, REPLACE, DELETE, PATCH, BATCH])
     @pytest.mark.parametrize("client_availability_strategy, request_availability_strategy", [
-        (None, {'threshold_ms':150, 'threshold_steps_ms':50}),
-        ({'threshold_ms':150, 'threshold_steps_ms':50}, None),
-        ({'threshold_ms':150, 'threshold_steps_ms':50},
-         {'threshold_ms':150, 'threshold_steps_ms':50})
+        (None, {'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50}),
+        ({'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50}, None),
+        ({'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50},
+         {'threshold_ms':STEADY_STATE_HEDGING_THRESHOLD_MS, 'threshold_steps_ms':50})
     ])
     async def test_availability_strategy_in_steady_state_async(
             self,
@@ -446,7 +449,7 @@ async def test_client_availability_strategy_failover_async(
                                FaultInjectionTransportAsync.predicate_targets_region(r, uri_down))
 
         error_lambda = lambda r: FaultInjectionTransportAsync.error_after_delay(
-            1000,  # Add delay to trigger hedging
+            FAULT_INJECTION_DELAY_MS,
             CosmosHttpResponseError(status_code=400, message="Injected Error")
         )
         custom_transport = self._get_custom_transport_with_fault_injection(predicate, error_lambda)
diff --git a/sdk/cosmos/pipeline/README.md b/sdk/cosmos/pipeline/README.md
index 70b768d77400..84e54628e770 100644
--- a/sdk/cosmos/pipeline/README.md
+++ b/sdk/cosmos/pipeline/README.md
@@ -1,3 +1,5 @@
+<!-- cspell:words issecret pmerge sdkci -->
+
 # Cosmos live-test accounts
 
 The Cosmos live tests bind to **fixed, team-owned Cosmos DB accounts** instead of provisioning a
diff --git a/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1 b/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
index d14dd78e037d..af7f1220a8af 100644
--- a/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
+++ b/sdk/cosmos/pipeline/resolve-cosmos-test-account.ps1
@@ -1,6 +1,7 @@
 #!/usr/bin/env pwsh
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
+# cspell:ignore issecret psobject
 
 <#
 .SYNOPSIS
diff --git a/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1 b/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
index 4006c814f443..03900b91a318 100644
--- a/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
+++ b/sdk/cosmos/pipeline/resolve-cosmos-test-account.tests.ps1
@@ -1,6 +1,7 @@
 #!/usr/bin/env pwsh
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
+# cspell:ignore issecret pscustomobject unscrubbed
 
 <#
 .SYNOPSIS

From 945a9eb4bfdac4dbdd156c1afa9bfe6d92f1df95 Mon Sep 17 00:00:00 2001
From: Simon Moreno <30335873+simorenoh@users.noreply.github.com>
Date: Thu, 6 Aug 2026 12:26:54 -0400
Subject: [PATCH 7/7] [cosmos] Isolate cross-partition test containers

Use a new container ID for every sync test invocation so a persistent data client cannot reuse session state after another client deletes and recreates the container.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: cb8202b3-2717-4b4a-92af-0a0a4cb223f3
---
 .../azure-cosmos/tests/test_query_cross_partition.py       | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sdk/cosmos/azure-cosmos/tests/test_query_cross_partition.py b/sdk/cosmos/azure-cosmos/tests/test_query_cross_partition.py
index faf4fa0dde22..b92db4c51f3e 100644
--- a/sdk/cosmos/azure-cosmos/tests/test_query_cross_partition.py
+++ b/sdk/cosmos/azure-cosmos/tests/test_query_cross_partition.py
@@ -30,7 +30,7 @@ class TestCrossPartitionQuery(unittest.TestCase):
     masterKey = config.masterKey
     connectionPolicy = config.connectionPolicy
     TEST_DATABASE_ID = config.TEST_DATABASE_ID
-    TEST_CONTAINER_ID = "Multi Partition Test Collection With Custom PK " + str(uuid.uuid4())
+    TEST_CONTAINER_ID_PREFIX = "Multi Partition Test Collection With Custom PK "
 
     @classmethod
     def setUpClass(cls):
@@ -48,8 +48,9 @@ def setUpClass(cls):
             test_config.TestConfig.create_test_clients(cls.TEST_DATABASE_ID, multiple_write_locations=use_multiple_write_locations))
 
     def setUp(self):
+        self.container_id = self.TEST_CONTAINER_ID_PREFIX + str(uuid.uuid4())
         created_container_ref = self.key_db.create_container(
-            id=self.TEST_CONTAINER_ID,
+            id=self.container_id,
             partition_key=PartitionKey(path="/pk"),
             offer_throughput=test_config.TestConfig.THROUGHPUT_FOR_5_PARTITIONS)
         self.created_container = self.created_db.get_container_client(created_container_ref.id)
@@ -59,7 +60,7 @@ def setUp(self):
 
     def tearDown(self):
         try:
-            self.key_db.delete_container(self.TEST_CONTAINER_ID)
+            self.key_db.delete_container(self.container_id)
         except exceptions.CosmosHttpResponseError:
             pass