Manage users, service principals, and groups
This article introduces the Azure Databricks identity management model and provides an overview of how to manage users, groups, and service principals in Azure Databricks.
For an opinionated perspective on how to best configure identity in Azure Databricks, see Identity best practices.
To manage access for users, service principals, and groups, see Authentication and access control.
Azure Databricks identities
There are three types of Azure Databricks identity:
- Users: User identities recognized by Azure Databricks and represented by email addresses.
- Service principals: Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
- Groups: A collection of identities used by admins to manage group access to workspaces, data, and other securable objects. All Databricks identities can be assigned as members of groups. There are two types of groups in Azure Databricks: account groups and workspace-local groups. For more information, see Types of groups in Azure Databricks.
A Azure Databricks account can have a maximum of 10,000 combined users and service principals, along with up to 5,000 groups. Each workspace also can have a maximum of 10,000 combined users and service principals as members, along with up to 5,000 groups.
For detailed instructions, see:
- Manage users
- Manage service principals
- Manage groups
- Sync users and groups from Microsoft Entra ID using SCIM
Who can manage identities in Azure Databricks?
To manage identities in Azure Databricks, you must have one of the following: the account admin role, the workspace admin role, or the manager role on a service principal or group.
Account admins can add users, service principals, and groups to the account and assign them admin roles. Account admins can update and delete users, service principals, and groups in the account. They can give users access to workspaces, as long as those workspaces use identity federation.
To establish your first account admin, see Establish your first account admin
Workspace admins can add users and service principals to the Azure Databricks account. They can also add groups to the Azure Databricks account if their workspaces are enabled for identity federation. Workspace admins can grant users, service principals, and groups access to their workspaces. They cannot delete users and service principals from the account.
Workspace admins can also manage workspace-local groups. For more information, see Manage workspace-local groups (legacy).
Group managers can manage group membership and delete the group. They can also assign other users the group manager role. Account admins have the group manager role on all groups in the account. Workspace admins have the group manager role on account groups that they create. See Who can manage account groups?.
Service principal managers can manage roles on a service principal. Account admins have the service principal manager role on all service principals in the account. Workspace admins have the service principal manager role on service principals that they create. For more information, see Roles for managing service principals.
Assign users to Azure Databricks
Databricks recommends syncing users, service principals, and groups from Microsoft Entra ID to Azure Databricks using automatic identity management (Public Preview).
Using automatic identity management, you can add users, service principals, and groups from Microsoft Entra ID into Azure Databricks without configuring an application in Microsoft Entra ID. When enabled, you can directly search in identity federated workspaces for Microsoft Entra ID users, service principals, and groups add them to your workspace and to the Azure Databricks account. Databricks uses Microsoft Entra ID as the source of record, so any changes to users or group memberships are respected in Azure Databricks. For detailed instructions, see Sync users and groups automatically from Microsoft Entra ID.
Users can share published dashboards with other users in the Azure Databricks account, even if those users are not members of their workspace. Using automatic identity management, users can share dashboards with any user in Microsoft Entra ID, which adds the user to the Azure Databricks account upon login. Users in the Azure Databricks account who are not members of any workspace are the equivalent of view-only users in other tools. They can view objects that have been shared with them, but they cannot modify objects. Users in a Azure Databricks account do not have any default access to a workspace, data, or compute resources. For more information, see User and group management for dashboard sharing.
Assign users to workspaces
To enable a user, service principal, or group to work in an Azure Databricks workspace, an account admin or workspace admin needs to assign them to a workspace. You can assign workspace access to users, service principals, and groups that exist in the account as long as the workspace is enabled for identity federation.
Workspace admins can also add a new user, service principal, or account group directly to a workspace. This action automatically adds the chosen user, service principal, or account group to the account and assigns them to that particular workspace.
Note
Workspace admins can also create legacy workspace-local groups in workspaces using the Workspace Groups API. Workspace-local groups are not automatically added to the account. Workspace-local groups cannot be assigned to additional workspaces, or granted access to data in a Unity Catalog metastore.
For those workspaces that aren’t enabled for identity federation, workspace admins manage their workspace users, service principals, and groups entirely within the scope of the workspace. Users and service principals added to non-identity federated workspaces are automatically added to the account. Groups added to non-identity federated workspaces are legacy workspace-local groups that are not added to the account.
If the workspace user shares a username (email address) with an account user or admin that already exists, those users are merged.
For detailed instructions, see:
Enable identity federation
Databricks began to enable new workspaces for identity federation and Unity Catalog automatically on November 9, 2023, with a rollout proceeding gradually across accounts. If your workspace is enabled for identity federation by default, it cannot be disabled. For more information, see Automatic enablement of Unity Catalog.
To enable identity federation in a workspace, an account admin needs to enable the workspace for Unity Catalog by assigning a Unity Catalog metastore. See Enable a workspace for Unity Catalog.
When the assignment is complete, identity federation is marked as Enabled on the workspace’s Configuration tab in the account console.
Workspace admins can tell if a workspace has identity federation enabled from the workspace admin settings page. In an identity federated workspace, when you choose to add a user, service principal, or group in workspace admin settings, you have the option to select a user, service principal, or group from your account to add to the workspace.
In a non-identity federated workspace, you do not have the option to add users, service principals, or groups from your account.
Assigning admin roles
Account admins can assign other users as account admins. They can also become Unity Catalog metastore admins by virtue of creating a metastore, and they can transfer the metastore admin role to another user or group.
Both account admins and workspace admins can assign other users as workspace admins. The workspace admin role is determined by membership in the workspace admins group, which is a default group in Azure Databricks and cannot be deleted.
Account admins can also assign other users as Marketplace admins.
See:
- Assign account admin roles to a user
- Assign the workspace admin role to a user using the workspace admin settings page
- Assign a metastore admin
- Assign the Marketplace admin role
Setting up single sign-on (SSO)
Single sign-on (SSO) in the form of Microsoft Entra ID-backed login is available in Azure Databricks for all customers by default. You can use Microsoft Entra ID single sign-on for both the account console and workspaces.