We're using Azure Databricks and automatic identity management. Users and groups sync over automatically.
If I want to grant permissions to an Entra group to a schema, I can't just run something like this in a workspace notebook:
GRANT USE SCHEMA ON SCHEMA xxx.yyy TO `Example Entra Group`;
It can't find the group. If I go to workspace settings -> security -> groups -> add group, and start typing the name of the group, it populates in a dropdown. If I click on the group it found, the browser makes a GraphQL call to "GetOrCreateIdpGroup". Once that's happened, I can cancel out of the "add group" dialog, and my GRANT query above starts working.
How can I do this programmatically using the API? Ideally at the workspace level.
I'd like to automate the assignment of groups to schemas using a job and service principal. I don't particularly care if the groups are in Entra or Databricks, but I'm trying to avoid using Databricks account-level APIs as they don't have fine-grained permissions: whatever process or job is creating a group in the Databricks account would need full admin privileges at the account level. I figured I could create the groups in Entra instead, because apps in Entra can be given access just to create groups. The group seems like it syncs over, but I can't use it in a GRANT command in a workspace until I go through the "add group" workspace UI above.
