topic Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST in Administration & Architecture

Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST

jonathanvdr — Fri, 13 Feb 2026 09:54:47 GMT

Problem statement: Unity catalog PRINCIPAL_DOES_NOT_EXIST when granting an entra group created via SDK, but works after manual UI assignment)

Hi all,

I'm running into a Unity Catalog identity resolution issue and I am trying to understand if this is expected behavior or if I'm missing something.

I created an external group with the databricks SDK workspaceclient and the group shows up correctly in my groups with the corresponding entra object id.

The first time I run:

GRANT ... TO `group`

I get PRINCIPAL_DOES_NOT_EXIST could not find principal with name.

While the group exists and is visible in the workspace.

Now the interesting part:

If I manually assign any privilege to that group via the Unity Catalog UI once, then the exact same SQL Grant statement works afterwards.

I feel like the Unity Catalog only materializes or resolves after the first UI interaction.

What would be a way to force UC to recognize entra groups without manual UI interaction?

Would really appreciatie insight from anyone who automated UC privilege assignment at scale.

By the way, what would be the best place to post technical questions like this?

Re: Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST

saurabh18cs — Fri, 13 Feb 2026 12:14:48 GMT

Hi @jonathanvdr can you use AccountClient instead of WorkspaceClient.

from databricks.sdk import AccountClient

Re: Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST

jonathanvdr — Fri, 13 Feb 2026 12:24:19 GMT

Hi @saurabh18cs,

I am not an account admin. I am a workspace admin though

Re: Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST

saurabh18cs — Fri, 13 Feb 2026 16:06:45 GMT

ideal approach is to sync entra groups at account level using SCIM sync of AD groups into Databricks groups and then let account admins sync this to workspace manually or using latest automated way. after than you GRANT access. you are following botttom up approach.