How to add Azure AD group into Databricks Premium cluster

Step 1: Configure Databricks As a Databricks account admin, log in to the Databricks account console. Click User Settings Icon Settings. Click User Provisioning. Click Enable user provisioning. Copy the SCIM token and the Account SCIM URL. You will use these to configure your Azure AD application.

Step 2: Configure the enterprise application These instructions tell you how to create an enterprise application in the Azure portal and use that application for provisioning. If you have an existing enterprise application, you can modify it to automate SCIM provisioning using Microsoft Graph. This removes the need for a separate provisioning application in the Azure Portal.

These steps enable Azure AD to sync users and groups to your Databricks account. This configuration is separate from any configurations you have created to sync users and groups to workspaces. In your Azure portal, go to Azure Active Directory > Enterprise Applications. Click + New Application above the application list. Under Add from the gallery, search for and select Azure Databricks SCIM Provisioning Connector. Enter a Name for the application and click Add. Under the Manage menu, click Provisioning. Set Provisioning Mode to Automatic. Set the SCIM API endpoint URL to the Account SCIM URL that you copied earlier. Set Secret Token to the Databricks SCIM token that you generated earlier. Click Test Connection and wait for the message that confirms that the credentials are authorized to enable provisioning. Click Save.

Step 3: Assign users and groups to the application Users and groups assigned to the SCIM application will be provisioned to the Databricks account. If you have existing Databricks workspaces, Databricks recommends that you add all existing users and groups in those workspaces to the SCIM application.

Go to Manage > Provisioning.

Under Settings, set Scope to Sync only assigned users and groups. Databricks recommends this option, which syncs only users and groups assigned to the enterprise application.

To start synchronizing Azure Active Directory users and groups to Azure Databricks, click the Provisioning Status toggle.

Click Save.

Go to Manage > Users and groups.

Add some users and groups. Click Add user, select the users and groups, and click the Assign button.

Wait a few minutes and check that the users and groups exist in your Azure Databricks account.

Users and groups that you add and assign will automatically be provisioned to the Databricks account when Azure Active Directory schedules the next sync.

Step 1: Create the enterprise application and connect it to the Databricks SCIM API To set up provisioning directly to Databricks workspaces using Azure Active Directory, you create an enterprise application for each Databricks workspace.

These instructions tell you how to create an enterprise application in the Azure portal and use that application for provisioning. If you have an existing enterprise application, you can modify it to automate SCIM provisioning using Microsoft Graph. This removes the need for a separate provisioning application in the Azure Portal.

As a workspace admin, log in to your Databricks workspace.

Generate a personal access token and copy it. You provide this token to Azure Active Directory in a subsequent step.

In your Azure portal, go to Azure Active Directory > Enterprise Applications.

Click + New Application above the application list. Under Add from the gallery, search for and select Azure Databricks SCIM Provisioning Connector.

Enter a Name for the application and click Add. Use a name that will help administrators find it, like -provisioning.

Under the Manage menu, click Provisioning.

Set Provisioning Mode to Automatic.

Enter the SCIM API endpoint URL. Append /api/2.0/preview/scim to your workspace URL: Copy to clipboardCopy https:///api/2.0/preview/scim Replace with the workspace URL of your Databricks deployment. See Get workspace, cluster, notebook, folder, model, and job identifiers.

Set Secret Token to the Databricks personal access token that you generated in step 1.

Click Test Connection and wait for the message that confirms that the credentials are authorized to enable provisioning.

Optionally, enter a notification email to receive notifications of critical errors with SCIM provisioning.

Click Save.

Step 2: Assign users and groups to the application Go to Manage > Provisioning.

Under Settings, set Scope to Sync only assigned users and groups.

Databricks recommends this option, which syncs only users and groups assigned to the enterprise application.

Note

Azure Active Directory does not support the automatic provisioning of nested groups to Databricks workspaces. Azure Active Directory can only read and provision users that are immediate members of the explicitly assigned group. As a workaround, explicitly assign (or otherwise scope in) the groups that contain the users who need to be provisioned. For more information, see this FAQ.

To start synchronizing Azure Active Directory users and groups to the Databricks workspace, click the Provisioning Status toggle.

Click Save.

Test your provisioning setup:

In your Databricks workspace, go to Manage > Users and groups.

Add some users and groups. Click Add user, select the users and groups, and click the Assign button.

Wait a few minutes and check that the users and groups exist in your Databricks workspace.

In the future, users and groups that you add and assign are automatically provisioned when Azure Active Directory schedules the next sync.