Unexpected Behavior with Azure Databricks and Entra ID SCIM Integration

[antonionuzzo]

Hi everyone,

I'm currently running some tests for a company that uses Entra ID as the backbone of its authentication system. Every employee with a corporate email address is mapped within the organization's Entra ID.

Our company's Azure Databricks is connected to Entra ID via SCIM. However, we've observed some unexpected behavior: a workspace admin in Azure Databricks is able to invite into their workspace any user that exists in the corporate Entra ID—even if that user has never accessed the cloud environment before.

How is this possible? Is there a way to mitigate this?

Ideally, I would expect that only users who have been granted access to the corporate cloud environments should be able to access Databricks.

[Alberto_Umana]

Hello @antonionuzzo,

This behavior is occurring because Azure Databricks allows workspace administrators to invite users from their organization's Entra ID directory into the Databricks workspace. This capability functions independently of whether the user has explicitly been granted access to a corporate cloud environment. When a SCIM integration is established with Entra ID, it synchronizes user identities to Databricks, enabling these users to be invited.

To mitigate this Azure Databricks provides a setting to control the ability of workspace administrators to invite users. You can manage this through the workspace's configuration settings using the restrict_workspace_admins feature. This limits workspace administrators, allowing only specified users or groups with predetermined access permissions to join the workspace