Azure Databricks Workspace: Users are being added to the admins group on their own

Chris O'Brien 0

We have an Azure Databricks workspace with Unity Catalog enabled. We are using SCIM provisioning to sync some Entra security groups to the workspace so that we can control access to the catalog items. We have noticed that some users are being added automatically to the workspace admin group. I can remove the users, but they slowly start reappearing in the admin group again without anyone selecting the option to add the users.

I'm not sure if SCIM provisioning could be causing this, but please can someone assist with what could be causing users to be added to the admin group on their own without anyone explicitly selecting the option to add them?

Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-04T03:45:31.3966667+00:00

Hi @Chris O'Brien

Just checking in to see if the below answer provided by @ Amira Bedhiafi helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-08T02:18:39.42+00:00

@Chris O'Brien

Thank you for providing the additional information. By following these steps, you should be able to identify and resolve the issue causing users to be automatically added to the Azure Databricks admin group.

SCIM Provisioning Configuration:

Group Mappings: Check Group Mappings - In your SCIM provisioning configuration in Microsoft Entra ID, ensure that you do not have any group mappings that might automatically add members of certain Entra security groups to the Azure Databricks admin group.

Nested Groups - Verify if there are any nested groups being synchronized. If a nested group that contains users is mapped to the Databricks admin group, its members will be added to the admin group automatically.

Provisioning Logs: Review Provisioning Logs - Go through the provisioning logs in Microsoft Entra ID to see if there are any patterns or specific rules that are causing users to be added to the Databricks admin group.

Unity Catalog Privileges:

Catalog-wide Settings: Check Catalog-wide Privileges - Review any catalog-wide settings in Unity Catalog to ensure that there are no configurations that automatically grant admin privileges to certain user groups or roles.

Specific Privileges: Catalog Level - Check if there are any privileges at the catalog level that might be causing the issue. Admin-level privileges might be inherited by users or groups with certain roles.

Schema and Table Level - Similarly, review schema and table-level permissions to ensure that no unintended admin privileges are being granted.

I hope this information helps. Please do let us know if you have any further queries.

Thank you.
Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-11T03:40:28.3066667+00:00

@Chris O'Brien

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you.
Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-12T01:07:33.7933333+00:00

@Chris O'Brien

Following up to see on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you.

1 answer

Amira Bedhiafi 26,491 Reputation points

2024-11-02T13:58:14.5833333+00:00

If users in your Azure Databricks workspace are being automatically added to the admin group without any direct action, the issue may be linked to SCIM provisioning or other group management settings.

First step to verify is to check if the SCIM provisioning configuration in Microsoft Entra ID does not include rules or mappings that automatically place certain security group members into the Databricks admin group.

You may have some nested groups that are being synchronized. If a nested group that contains users is provisioned as part of an admin group, its members may be included automatically.

With Unity Catalog, users and groups can inherit privileges based on catalog configurations so try that there are no catalog-wide settings that automatically promote certain user groups or specific roles to admin privileges.

Have you checked also if there are custom sync rules or scripts in Microsoft Entra ID that trigger user promotions based on specific attributes or conditions ?

One last thing, if you are using any third-party identity management tools or systems that may have access to both Azure Databricks and Microsoft Entra ID, keep in mind that these tools could be orchestrating changes based on predefined roles or permissions.
Please sign in to rate this answer.
Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-05T01:21:03.5733333+00:00

Hi @Chris O'Brien

Just checking in to see if the above answer provided by @ Amira Bedhiafi helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Chris O'Brien 0 Reputation points

2024-11-06T07:16:04.1833333+00:00

Hi Amira, thank you for the feedback!

Are you able to assist with which SCIM provisioning configuration could be causing this? As mentioned in the issue, I understand that SCIM may be causing this, but don't understand which specific settings or configurations it could be. We've created some security groups in Entra and are using SCIM to provision them in Databricks, I'm not sure what configuration here would make some users admins and others not.

Similarly for Unity Catalog, which privileges could cause this? There are lots of permissions available, such as catalog level, schema and table level and I will need some kind of understanding on which specific permissions could cause this. Once SCIM has provisioned the security groups we have applied permissions to them for the different catalogs, schemas and tables we are working with so my initial thoughts are that this is where it is more likely that the issue is coming from.

There are no custom sync rules or scripts in Entra ID or third party management tools.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Databricks Workspace: Users are being added to the admins group on their own

1 answer

Your answer