From 465b059b5f476b58b034137c997ab81c1e474f6f Mon Sep 17 00:00:00 2001
From: Asier Isayas <aisayas@microsoft.com>
Date: Thu, 27 Aug 2026 15:23:24 -0400
Subject: [PATCH] Preserve connection restriction check order

---
 .../Components/ConnectExplorer.test.tsx       |  2 +-
 .../Hosted/Components/ConnectExplorer.tsx     | 24 +++++++++----------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/Platform/Hosted/Components/ConnectExplorer.test.tsx b/src/Platform/Hosted/Components/ConnectExplorer.test.tsx
index bdc562820..251502f27 100644
--- a/src/Platform/Hosted/Components/ConnectExplorer.test.tsx
+++ b/src/Platform/Hosted/Components/ConnectExplorer.test.tsx
@@ -101,7 +101,7 @@ it("rejects an unrecognized connection string before token exchange", async () =
       "We couldn't recognize this connection string. Verify that it is a valid Azure Cosmos DB connection string and try again.",
     ),
   ).toBeInTheDocument();
-  expect(mockIsAccountRestricted).not.toHaveBeenCalled();
+  expect(mockIsAccountRestricted).toHaveBeenCalledWith("not-a-valid-connection-string");
   expect(mockFetchEncryptedToken).not.toHaveBeenCalled();
 });
 
diff --git a/src/Platform/Hosted/Components/ConnectExplorer.tsx b/src/Platform/Hosted/Components/ConnectExplorer.tsx
index 26c60e1d5..f32483092 100644
--- a/src/Platform/Hosted/Components/ConnectExplorer.tsx
+++ b/src/Platform/Hosted/Components/ConnectExplorer.tsx
@@ -58,6 +58,18 @@ export const ConnectExplorer: React.FunctionComponent<Props> = ({
                 setIsConnecting(true);
 
                 try {
+                  try {
+                    if (await isAccountRestrictedForConnectionStringLogin(connectionString)) {
+                      setErrorMessage(
+                        "This account has been blocked from connection-string login. Please go to cosmos.azure.com/aad for AAD based login.",
+                      );
+                      return;
+                    }
+                  } catch (error) {
+                    setErrorMessage(getErrorMessage(error as Error));
+                    return;
+                  }
+
                   if (isResourceTokenConnectionString(connectionString)) {
                     setAuthType(AuthType.ResourceToken);
                     return;
@@ -71,18 +83,6 @@ export const ConnectExplorer: React.FunctionComponent<Props> = ({
                     return;
                   }
 
-                  try {
-                    if (await isAccountRestrictedForConnectionStringLogin(connectionString)) {
-                      setErrorMessage(
-                        "This account has been blocked from connection-string login. Please go to cosmos.azure.com/aad for AAD based login.",
-                      );
-                      return;
-                    }
-                  } catch (error) {
-                    setErrorMessage(getErrorMessage(error as Error));
-                    return;
-                  }
-
                   if (isDirectConnectionStringLoginApi(metadata.apiKind)) {
                     setAccountMetadata(metadata);
                     setAuthType(AuthType.ConnectionString);