Unity catalog resolution of Entra Groups: PRINCIPAL_DOES_NOT_EXIST

[jonathanvdr]

Problem statement: Unity catalog PRINCIPAL_DOES_NOT_EXIST when granting an entra group created via SDK, but works after manual UI assignment)

Hi all,

I'm running into a Unity Catalog identity resolution issue and I am trying to understand if this is expected behavior or if I'm missing something.

I created an external group with the databricks SDK workspaceclient and the group shows up correctly in my groups with the corresponding entra object id.

The first time I run:

GRANT ... TO `group`

I get PRINCIPAL_DOES_NOT_EXIST could not find principal with name.

While the group exists and is visible in the workspace.

Now the interesting part:

If I manually assign any privilege to that group via the Unity Catalog UI once, then the exact same SQL Grant statement works afterwards.

I feel like the Unity Catalog only materializes or resolves after the first UI interaction.

What would be a way to force UC to recognize entra groups without manual UI interaction?

Would really appreciatie insight from anyone who automated UC privilege assignment at scale.

By the way, what would be the best place to post technical questions like this?

[saurabh18cs]

Hi @jonathanvdr can you use AccountClient instead of WorkspaceClient.

from databricks.sdk import AccountClient

[jonathanvdr]

Hi @saurabh18cs,

I am not an account admin. I am a workspace admin though

[saurabh18cs · Accepted solution]

ideal approach is to  sync entra groups at account level using SCIM sync of AD groups into Databricks groups and then let account admins sync this to workspace manually or using latest automated way. after than you GRANT access. you are following botttom up approach.