topic Re: azure databricks automatic user provisioning via terraform in Administration & Architecture

azure databricks automatic user provisioning via terraform

oktarinet — Mon, 12 May 2025 15:37:29 GMT

Hi community,

Azure databricks recently announced a new user management feature (now in public preview) called automatic-identity-management , which allows Azure databricks to access Azure Entra ID directly and grant users and groups permissions and roles in Databricks directly, without needing a SCIM provisioning application.

I have enabled this feature and have successfully provisioned test users into my workspace. However, I have not been successful at configuring this through Terraform.
Here is some code I have attempted:

resource "databricks_group" "test" { display_name = "auto-provisioning-test" allow_cluster_create = true workspace_access = true } data "azuread_group" "test" { display_name = "SGA_DATABRICKS_Test" # Entra group } resource "databricks_group_member" "test" { group_id = databricks_group.test.id member_id = data.azuread_group.test.object_id }

I also tried

data "databricks_group" "test" { display_name = "SGA_DATABRICKS_Test" # Entra group }

But both attempts gave me a "Error: cannot read group member: Group has no member" error.

Is there a correct way to do this?

Re: azure databricks automatic user provisioning via terraform

oktarinet — Fri, 16 May 2025 09:00:04 GMT

see https://github.com/databricks/terraform-provider-databricks/issues/4687#issuecomment-2875157936

Re: azure databricks automatic user provisioning via terraform

saurabh18cs — Fri, 16 May 2025 10:16:14 GMT

Hi , I think

The automatic identity management feature provisions Azure Entra ID users and groups directly into Databricks. However, Terraform's databricks_group and databricks_group_member resources are designed for managing groups and memberships within Databricks, not for managing Azure Entra ID groups directly.
The error Group has no member occurs because the databricks_group resource is trying to manage a group that is already being managed by Azure Entra ID through automatic provisioning.