Azure Cosmos DB
The best-positioned data service in this catalog for tight RPO/RTO — but only if you explicitly enable Per-Partition Automatic Failover (PPAF). The default 'service-managed failover' setting most teams reach for can take an hour or more to trigger.
Single region, no explicit zone redundancy
Cosmos DB always keeps 4 synchronous replicas per partition within a region regardless of zone settings — node/disk failure is handled transparently by the platform.
- Replication
- Synchronous
- RPO
- 0 for in-region replica loss
- RTO
- No customer-visible downtime for a single replica loss — fully platform-managed
- Failover trigger
- Automatic
A zone-wide event can still affect availability if zone redundancy isn't separately enabled.
Zone redundancy enabled (per region)
Replicas synchronously spread across Availability Zones. Detection, response, and recovery are fully managed — Microsoft's docs state explicitly that no customer action is required.
- Replication
- Synchronous
- RPO
- 0
- RTO
- Not explicitly quantified by Microsoft — described as fully managed with no required customer action
- Failover trigger
- Automatic
Configured separately per region on a multi-region account; has no discernible performance/latency cost.
Multi-region with Per-Partition Automatic Failover (PPAF)
PPAF lets individual partitions fail over to a secondary region automatically, without waiting for a whole-account failover — Microsoft's docs describe typical recovery around 3 minutes with no manual intervention.
- Replication
- Asynchronous
- RPO
- 0 with Strong consistency; <15 min for Session/Eventual/Consistent-prefix; K-operations/T-seconds for Bounded Staleness (configurable, minimum ~100,000 writes or 300 sec)
- RTO
- Typically ~3 minutes, described as automatic — treated here as guidance rather than a contractual guarantee
- Failover trigger
- Automatic
Must be explicitly enabled per account. Without PPAF, the fallback is 'service-managed failover', which Microsoft states can take an hour or more to trigger — or a customer-triggered 'forced failover', fast once initiated but manual.
Gotchas
The default failover setting is the slow one
Most multi-region Cosmos DB accounts rely on 'service-managed failover' — Microsoft's own documentation says this can take an hour or more to declare an outage and trigger. PPAF (the fast, automatic option) is a separate, explicit opt-in, not the default behavior of a multi-region account.
RPO is entirely a function of consistency level
Only Strong consistency guarantees zero data loss on failover — and Strong consistency is unavailable on multi-region multi-write accounts. Session/Eventual/Consistent-prefix accept up to ~15 minutes of loss; Bounded Staleness's floor is 100,000 operations or 300 seconds, whichever is reached first.
Forced failover is fast, but it's still on you to trigger
A customer-initiated forced failover typically completes in a few seconds once started — the real RTO driver is how long it takes your team to detect the outage and decide to pull the trigger, which Microsoft's stated numbers don't include.