https://community.databricks.com/t5/administration-architecture/how-to-setup-service-principal-to-assing-account-level-groups-to/m-p/65396#M1042 <P>Based on best practices, we have set up <A href="https://docs.databricks.com/en/administration-guide/users-groups/scim/aad.html" target="_self">SCIM provisioning using Microsoft Entra ID</A> to synchronize Entra ID groups to our Databricks account. All workspaces have identity federation enabled.</P><P>However, how should workspace administrators assign account-level groups to their workspaces via terraform once they have been synchronized to the Databricks account? The Databricks provider documentation for the "<A href="http://databricks_permission_assignment" target="_self">databricks_permission_assignment</A>" resource provides an example that uses a dedicated provider on account level. When attempting to read the group on account-level using a service principal with workspace adminstrator rights only returns an error (status 401). Based on some (more or less cryptic) descriptions, <STRONG><EM>any</EM></STRONG>&nbsp;account-level API can only be accessed by credentials with "Account Admin" rights (<A href="https://docs.databricks.com/api/azure/account/introduction" target="_self">example reference</A>).</P><P>For obvious reasons, service principals used to manage terraform state of a specific workspace should not be granted "Account Admin" rights. How can the service principal set up in a way that allows fetching the group id without granting "Account Admin" rights? Are there additional workspace-level APIs that I'm not aware of that can be used instead?</P> Wed, 03 Apr 2024 11:11:27 GMT DavidZS 2024-04-03T11:11:27Z https://community.databricks.com/t5/administration-architecture/how-to-setup-service-principal-to-assing-account-level-groups-to/m-p/65396#M1042 <P>Based on best practices, we have set up <A href="https://docs.databricks.com/en/administration-guide/users-groups/scim/aad.html" target="_self">SCIM provisioning using Microsoft Entra ID</A> to synchronize Entra ID groups to our Databricks account. All workspaces have identity federation enabled.</P><P>However, how should workspace administrators assign account-level groups to their workspaces via terraform once they have been synchronized to the Databricks account? The Databricks provider documentation for the "<A href="http://databricks_permission_assignment" target="_self">databricks_permission_assignment</A>" resource provides an example that uses a dedicated provider on account level. When attempting to read the group on account-level using a service principal with workspace adminstrator rights only returns an error (status 401). Based on some (more or less cryptic) descriptions, <STRONG><EM>any</EM></STRONG>&nbsp;account-level API can only be accessed by credentials with "Account Admin" rights (<A href="https://docs.databricks.com/api/azure/account/introduction" target="_self">example reference</A>).</P><P>For obvious reasons, service principals used to manage terraform state of a specific workspace should not be granted "Account Admin" rights. How can the service principal set up in a way that allows fetching the group id without granting "Account Admin" rights? Are there additional workspace-level APIs that I'm not aware of that can be used instead?</P> Wed, 03 Apr 2024 11:11:27 GMT https://community.databricks.com/t5/administration-architecture/how-to-setup-service-principal-to-assing-account-level-groups-to/m-p/65396#M1042 DavidZS 2024-04-03T11:11:27Z https://community.databricks.com/t5/administration-architecture/how-to-setup-service-principal-to-assing-account-level-groups-to/m-p/65544#M1048 <P>Have you tried giving Manager role on the group to the service principal which is workspace admin? Once you do this you may be able to use the settings to&nbsp;&nbsp;<SPAN>In workspace context, adding account-level group to a workspace in&nbsp;</SPAN>databricks_permission_assignment</P> Fri, 05 Apr 2024 00:50:45 GMT https://community.databricks.com/t5/administration-architecture/how-to-setup-service-principal-to-assing-account-level-groups-to/m-p/65544#M1048 Walter_C 2024-04-05T00:50:45Z