topic Re: How do I simply disable someone's user account in Administration & Architecture

How do I simply disable someone's user account

Aaron_Wong — Mon, 11 Nov 2024 20:42:58 GMT

I'm trying to do something seemingly very simple - disable someone's user account.

I don't even want to delete the user, just disable it for the time being.

How do I go about doing that?

Re: How do I simply disable someone's user account

Stefan-Koch — Tue, 12 Nov 2024 05:49:51 GMT

Hello Aaron

You can disable the user account in the directory of your cloud provider. For example, if you are using Azure Databricks, then you will manage the users via Azure Entra. Then you can simply deactivate the user account in Entra, for example, by unchecking the “Account enabled” button.

If you want the user to remain active in the cloud after all and just not be allowed to access Databricks Workspace, you can remove them from the workspace.

The user is not deleted in Entra, but merely removed from the workspace. It can still be found in the account.

Re: How do I simply disable someone's user account

Aaron_Wong — Wed, 13 Nov 2024 15:25:25 GMT

Ah, thanks for the reply Stefan! I should have clarified that I'm using Databricks via the AWS Marketplace.

The issue I'm encountering when I'm trying to remove someone, is that it will say "User assigned through a group cannot be deleted". However, when I go and try to remove the person from the group, I encounter this error:

PERMISSION_DENIED: Requesting user does not have permission to edit system groups.

However, I'm an admin on both the account and workspace.

Let me know! Thanks!

Re: How do I simply disable someone's user account

Stefan-Koch — Wed, 13 Nov 2024 16:58:42 GMT

Aaron

Is the user in another group as well? You may first remove him from that group, if it is so?

Re: How do I simply disable someone's user account

arjun_kr — Wed, 13 Nov 2024 20:45:54 GMT

Looks like you have users added via the system group 'account users' to the workspace. This is a system group and cannot be edited. You may make the user inactive at the workspace level using `Users` Patch API as shown below. You may get the userId from the user details page URL (for eg : 123 being the user Id from user details page : https://abc.cloud.databricks.com/settings/workspace/identity-and-access/users/123?o=456)
```

curl --request PATCH '{{workspaceUrl}}/api/2.0/preview/scim/v2/Users/<UserId>' \ --header 'Accept: application/scim+json' \ --header 'Content-Type: application/json' \ --header 'Authorization: <Token>' \ --data '{ "schemas": [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ], "Operations": [ { "op": "replace", "path": "active", "value": [ { "value": "false" } ] } ] }'

Re: How do I simply disable someone's user account

Aaron_Wong — Thu, 14 Nov 2024 15:55:44 GMT

Thanks! I'll try this out and report back!

Re: How do I simply disable someone's user account

Aaron_Wong — Fri, 15 Nov 2024 16:49:06 GMT

Hello! I tried this call. I hid the sensitive information with "HIDDEN" in the example:

curl --request PATCH 'https://HIDDEN.cloud.databricks.com/api/2.0/preview/scim/v2/Users/HIDDEN' \ --header 'Accept: application/scim+json' \ --header 'Content-Type: application/json' \ --header 'Authorization: HIDDEN' \ --data '{ "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{ "op": "replace", "path": "active", "value": false }] }'

But I'm getting this error for some reason:

SyntaxError: unterminated string literal (detected at line 5) (command-194238644311154-3846552969, line 5)

Any help is much appreciated!

Re: How do I simply disable someone's user account

arjun_kr — Thu, 05 Dec 2024 22:46:39 GMT

It looks like you might have run it as non-shell command. I can see the same error with the curl command being executed as a python command. Can you try executing it as a shell command by using %sh magic command

%sh curl --request PATCH 'https://HIDDEN.cloud.databricks.com/api/2.0/preview/scim/v2/Users/HIDDEN' \ --header 'Accept: application/scim+json' \ --header 'Content-Type: application/json' \ --header 'Authorization: HIDDEN' \ --data '{ "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{ "op": "replace", "path": "active", "value": false }] }'

Re: How do I simply disable someone's user account

maaz1 — Wed, 12 Mar 2025 21:34:30 GMT

In Databricks, go to the Admin Console.
Navigate to the Service Principals section.
Create a Service Role (make sure it has necessary permissions (Admin Access).
Generate OAuth Token
Follow the instructions in the Databricks documentation to generate api access token for the service role: Follow instuction to generate the token OAuth M2M Manual Setup.
After completing the setup, you'll have a Bearer Token for the service role.
Once you have the Bearer Token, hit the curl --location --request DELETE 'https://accounts.cloud.databricks.com/api/2.0/accounts/YOUR_ACCOUNT_ID/scim/v2/Users/YOUR_USER_ID/' \ --header 'Authorization: Bearer YOUR_BEARER_TOKEN'