Applies toAzure Databricks accounts with Unity Catalog, Microsoft Entra ID, automatic identity management or SCIM provisioning
Provisioning options
| Option | Notes |
|---|---|
| Automatic identity management | Databricks syncs users/groups from Entra ID on demand; nested groups supported; check enablement on your account |
| SCIM provisioning (Entra enterprise app) | Pushes assigned users/groups to the account; nested groups need flattening |
| Manual | Only for labs; doesn't scale |
Provision to the account, then assign identities to workspaces. Workspace-local groups are legacy; convert them to account groups.
Group model
| Group type | Example | Granted |
|---|---|---|
| Domain readers | dbx-sales-readers | USE CATALOG, SELECT on sales gold |
| Domain engineers | dbx-sales-engineers | Write on sales schemas in dev; read in prod |
| Platform admins | dbx-platform-admins | Metastore/workspace admin (small) |
| Workspace users | dbx-ws-prod-users | Workspace access entitlement |
Groups are owned in Entra ID with access reviews. Databricks grants reference groups only.
Service principals
- One per pipeline or application (e.g.
sp-sales-ingest-prod), not one shared by everything. - Entra ID-managed service principals; authenticate with OAuth (workload identity federation for CI where possible; see the PAT to OAuth transformation post).
- Own production jobs and run them as the service principal (
run_as). - Grant only the schemas/tables the pipeline needs.
Admin roles
| Role | Keep to |
|---|---|
| Account admin | 2–3 named people plus break-glass |
| Metastore admin | A group, not individuals (see the lost admin Sev1 post) |
| Workspace admin | Platform team group |
| Catalog owners | Domain admin groups |
Audit admin role changes via system audit logs.
Joiners, movers, leavers
| Event | Handled by |
|---|---|
| Joiner | Added to Entra groups → synced → access through grants |
| Mover | Group membership changes; no direct grants to clean up |
| Leaver | Disabled in Entra → deprovisioned; owned objects transferred (check ownership of jobs, tables, queries) |
-- Objects owned by individual users (to transfer to groups/SPs)
SELECT table_catalog, table_schema, table_name, table_owner
FROM system.information_schema.tables
WHERE table_owner LIKE '%@%';
Tip
Make "no grants to individual users" a rule and check it with a scheduled query on information_schema privileges. Exceptions then become visible instead of piling up.
Checklist
- Account-level provisioning from Entra ID
- Workspace-local groups converted
- Group model documented and owned in Entra
- Service principal per pipeline, OAuth auth
- Admin roles minimal and audited
- Leaver ownership transfer process