topic Re: Workload Identity Federation on ADO for account level provider in Administration & Architecture

Workload Identity Federation on ADO for account level provider

eshwari — Mon, 20 Jul 2026 17:09:21 GMT

I am using Workload Identity Federation for ADO pipelines to authenticate to databricks.

I followed https://docs.databricks.com/aws/en/dev-tools/auth/provider-azure-devops

It works with workspace url but doesn't work with account level url.

I get error: failed during request visitor: default auth: Post "https://accounts.azuredatabricks.net/oidc/accounts/<accountid>/v1/token": Post "https://accounts.azuredatabricks.net/oidc/accounts/<accountid>/v1/token": EOF. Config: host=https://accounts.azuredatabricks.net, account_id=<accountid>, azure_client_id=***, azure_tenant_id=<tenantid>, client_id=***. Env: ARM_CLIENT_ID, ARM_TENANT_ID, DATABRICKS_CLIENT_ID

Re: Workload Identity Federation on ADO for account level provider

zubisid19 — Mon, 20 Jul 2026 19:34:51 GMT

You are using:

Azure-style host: https://accounts.azuredatabricks.net
Azure env vars: ARM_CLIENT_ID, ARM_TENANT_ID
Plus DATABRICKS_CLIENT_ID
That often makes the SDK try a different OIDC flow than intended (hitting /oidc/accounts/<id>/v1/token) and failing with EOF.

Also, your doc link is under .../aws/..., which may not match your Azure Databricks account setup.

Fix checklist
1) Use the correct cloud flow
If this is Azure Databricks, use Azure-specific auth guidance (not AWS path).

If this is actually Databricks on AWS, your account host should be:

https://accounts.cloud.databricks.com and you should not use ARM_* vars.
2) Do not mix auth methods
Pick one method only. For Azure workload identity, avoid mixing with unrelated Databricks OAuth vars.

Try removing DATABRICKS_CLIENT_ID first and keep only the Azure WIF-required vars + Databricks host/account settings.

3) Minimal account-level env (Azure pattern)
DATABRICKS_HOST=https://accounts.azuredatabricks.net
DATABRICKS_ACCOUNT_ID=<account_id>
Azure WIF vars from your pipeline/service connection (client/tenant/OIDC token)
Optional: set explicit auth type if your tooling supports it
4) Validate with CLI debug
Run below cli command -
databricks auth env --debug
Then test an account API call:

cli command -
databricks account users list --debug

5) If still EOF, check network/proxy
EOF can also be proxy/TLS interruption to accounts.azuredatabricks.net. Test from agent:

cli command -
curl -v https://accounts.azuredatabricks.net

If blocked, fix proxy/no_proxy/firewall rules.

Re: Workload Identity Federation on ADO for account level provider

eshwari — Tue, 21 Jul 2026 08:25:00 GMT

It was firewall issue, had to add new rule to allow it.
Thank you for your help.