Azure Cosmos DB is a cloud-native distributed database, operating at a massive scale, powering Microsoft Cloud. Think 10s of millions of database partitions (replica-sets), 100+ PBs of data under management, 20M+ vCores. Failovers are an integral part of distributed databases to provide data availability during outages (partial or full regional outages). While failovers within a replica-set within a single region are well understood and commonly exercised, geo failovers in databases across regions are not as common and usually left as a disaster recovery scenario. An upcoming release of Azure Cosmos DB introduces a fine grained (partition-level) automatic failover solution for geo failovers that minimizes the Recovery Time Objective (RTO) and honors customer-chosen consistency level and Recovery Point Objective (RPO) at any scale. This is achieved thanks to a decentralized architecture which offers seamless horizontal scaling to allow us to handle outages ranging from node-level faults to full-scale regional outages. Our solution is designed to handle a broad spectrum of hardware and software faults, including node failures, crashes, power events and most network partitions, that span beyond the scope of a single fault domain or an availability zone.
Cite
@article{arxiv.2505.14900,
title = {Implementing Decentralized Per-Partition Automatic Failover in Azure Cosmos DB},
author = {Josh Rowe and Mikael Horal and Hari Sudan Sundar and Muthukumaran Arumugam and Burak Kose and Sravani Mitra Palivela and Geni Marsh and Varun Jain and Abhishek Kumar and Dhaval Patel},
journal= {arXiv preprint arXiv:2505.14900},
year = {2025}
}