Azure Databricks SCIM provisioning configured, working...but what happens when user is deleted?

[m997al]

Hi - I have Azure Databricks with Unity Catalog, and the SCIM Connector provisioning up and working.

Due to a misunderstanding on my part, I deleted some individual users (using the Databricks admin console) thinking that I was deleting individual accounts in Databricks (a legacy setup for us).

Instead, I saw that not only did I delete the user account, but I deleted the user from the Group in Databricks that they were properly in as well.

This group (let's call it "dbusers") was/is propagated via the SCIM connector from Azure AD to Azure Databricks.

So now I am in a situation where the Azure AD group is 100% correct (users still there), while the Azure Databricks group (which should be basically a copy of the AD group) is missing the members that I deleted inside Databricks.

Unfortunately, deleting and then re-adding the users in the AD group is no re-propagating them to Databricks.  I have confirmed that completely new users can still be properly pushed to the Databricks group from the AD group via the SCIM connection.

This seems like some sort of weird sync issue between the Databricks group (which has a source of the AD group) and the AD group.

Any ideas here?  Thus far I am not able to add back the users I mistakenly deleted not just from the individual users but from the Databricks group as well.  Thanks.

[m997al]

Hi - having no luck at all here.  We have tried triggering full provisionings for the Databricks SCIM connector in Azure to propagate this group again to Databricks, but the group will not update with the users that were deleted inside Databricks.  We tried deleting the user in the AD group and adding them back, and then provisioning... no luck.

This is becoming a tricky problem.  We don't want to have to delete the AD group and recreate it anew, but something is going on with the SCIM provisioning that won't let us re-sync users NOT deleted in the AD group, but mistakenly deleted inside of Databricks.

[m997al]

This was resolved...but why it was resolved remains a mystery.  We simply re-provisioned by turning off and then on the SCIM provisioning in the Azure portal for the Databricks SCIM connector (which is supposed to cause a full re-provisioning, but didn't seem to do that last week).

There are some good pieces of information here: Configure SCIM provisioning using Microsoft Entra ID (Azure Active Directory) - Azure Databricks | M...

...in particular, it appears from the tips in that link that you can manually add back users inside of Databricks that were mistakenly deleted inside Databricks, and the synching from the SCIM connector should still work fine.

Finally, there is a check-box in the provisioning section in Azure portal for the Databricks SCIM connector, which say "prevent accidental deletion".  We didn't check that box, but wondered what it does.