topic On-behalf-of token creation for service principals is not enabled for this workspace in Data Engineering

On-behalf-of token creation for service principals is not enabled for this workspace

Ajay-Pandey — Tue, 19 Mar 2024 10:49:13 GMT

Hi All

I just wanted to create PAT for Databricks Service Principle but getting below code while hitting API or using CLI -

Please help me to create PAT for the same.

#dataengineering #databricks

Re: On-behalf-of token creation for service principals is not enabled for this workspace

Ajay-Pandey — Tue, 19 Mar 2024 12:25:45 GMT

@Retired_mod I have already referred this one but still having issue
I have created Service Account in Databricks and I am not using Azure Service Principle

Re: On-behalf-of token creation for service principals is not enabled for this workspace

Ajay-Pandey — Tue, 19 Mar 2024 15:04:23 GMT

Hi @Retired_mod ,

I have given all the permissions (Admin) to Service Principle and still having the same issue.

Please find all the details below -

Re: On-behalf-of token creation for service principals is not enabled for this workspace

Ajay-Pandey — Mon, 08 Apr 2024 04:59:04 GMT

Hi @Retired_mod
Have you got any update on this ?

Re: On-behalf-of token creation for service principals is not enabled for this workspace

MorpheusGoGo — Thu, 19 Sep 2024 10:11:52 GMT

This only works if you are on AWS or GCP, no support for Azure 😞

Check the API documentation AWS - https://docs.databricks.com/api/workspace/tokenmanagement/createobotoken

No such documentation exists for Azure.

Re: On-behalf-of token creation for service principals is not enabled for this workspace

JackB — Thu, 24 Apr 2025 20:43:49 GMT

You can generate the token while logged in as the Service Principle via the Azure CLI in a Command Prompt window. To do so, make sure to install the Azure CLI and the Databricks CLI with it.

I used the following commands in the Command Prompt window. Hope this helps.

First Command – Log in as the Service Principal using the secret value. The secret value is created via https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret

az login --service-principal -t <tenant id> -u <client id> -p <secret value> --allow-no-subscriptions

Second Command while logged in as the Service Principal

databricks tokens create --lifetime-seconds 15780096 --comment <service principle name>