Home / Databricks on Azure

Databricks on AzureRunbookAdvanced

Sev1: nobody can administer Unity Catalog — account admin or metastore admin lost

Regain administration of an Azure Databricks account and Unity Catalog metastore after the only admin left, an admin group was deleted in Entra ID or SCIM removed members. Use Entra Global Administrator bootstrap rights, restore groups and set up resilient admin ownership.

Deepak Bhardwaj3 min read

Applies toAzure Databricks account console, Unity Catalog metastores, Microsoft Entra ID, SCIM provisioning

Symptoms

  • No one can open the account console or create catalogs, grant permissions or manage the metastore.
  • The metastore admin is a person who left, or a group that SCIM sync emptied.
  • PERMISSION_DENIED on CREATE CATALOG for everyone.

Who can fix it

Role Can
Azure Databricks account admin Manage the account: users, groups, workspaces, metastores; assign metastore admin
Metastore admin Manage all objects and grants in a metastore
Microsoft Entra Global Administrator Can sign in to the account console and act as account admin on Azure Databricks (this is how first-time account setup works)

So if all account admins are gone, a Global Administrator of the Entra tenant can sign in to https://accounts.azuredatabricks.net and restore admins. Check the current documentation for this bootstrap behaviour in your setup.

1. Restore account admins

Account console → User management → pick a user or group → Roles → Account admin. Using the CLI with an account-level profile:

databricks account users list --profile ACCOUNT
databricks account groups list --profile ACCOUNT

Prefer a group (dbx-account-admins) with at least two people plus a break-glass account.

2. Restore metastore admin

Account console → Catalog → the metastore → Metastore admin → set to an admin group.

databricks account metastores update <metastore-id> --json '{"metastore_info": {"owner": "dbx-metastore-admins"}}' --profile ACCOUNT

3. If SCIM emptied a group

When the Entra group behind the admin group was deleted or unassigned from the enterprise app, SCIM removes its members in Databricks.

  • Re-create/reassign the Entra group to the Azure Databricks SCIM Provisioning Connector app and let provisioning run (or "Provision on demand" for named users).
  • Check provisioning logs in Entra for errors.
  • Recent releases support automatic identity management syncing Entra groups without the SCIM app; check which method your account uses.

4. Fix object ownership

Objects owned by the departed person still work but can't be administered by others easily. As metastore admin, transfer ownership:

ALTER CATALOG sales OWNER TO `grp-sales-data-owners`;
ALTER SCHEMA sales.products OWNER TO `grp-sales-data-owners`;
ALTER TABLE sales.products.orders OWNER TO `grp-sales-data-owners`;
ALTER EXTERNAL LOCATION ext_sales_raw OWNER TO `grp-platform-admins`;
ALTER STORAGE CREDENTIAL sc_sales OWNER TO `grp-platform-admins`;

Find objects owned by individuals:

SELECT table_catalog, table_schema, table_name, table_owner
FROM system.information_schema.tables
WHERE table_owner LIKE '%@%' ORDER BY table_owner;

5. Jobs owned by the departed user

Jobs run as their owner (or a run-as identity). If the user was deactivated, their jobs fail. Change run-as to a service principal:

databricks jobs update <job-id> --json '{"new_settings": {"run_as": {"service_principal_name": "<sp-application-id>"}}}'

Prevent it next time

  • Account admin and metastore admin = groups, never individuals; at least two members each.
  • A documented break-glass path (Entra Global Admin procedure).
  • Catalog/schema owners = groups; production jobs run as service principals.
  • Alert on changes to admin groups in Entra.

Related fixes