10-31-2024 06:07 AM
We would like to have the ability to assign an individual and/or group to the "Group: Manager" role, providing them with the ability to add/remove users without the need to be an account or workspace administrator. Ideally this would be an option for the group manager within the user interface, but we'd also be OK with an API solution.
It does look like Databricks is working towards this, as Account & Workspace managers are able to assign a principal to a "Group: Manager" role (screenshot), but we have not been able to figure out a way yet to take advantage of that.
We've tried following the API documentation listed here, but have not been able to get anything to work that doesn't require the user to also be a workspace manager.
Curious if anyone has been successful in implementing this concept? Or if there's a roadmap from Databricks on this functionality?
10-31-2024 07:08 AM
You can also use the Account Groups API to assign the "Group: Manager" role. Here is an example of how to do this:
curl --netrc -X PATCH \
https://${DATABRICKS_HOST}/api/2.1/accounts/{account_id}/scim/v2/Groups/{id} \
--header 'Content-type: application/scim+json' \
--data @update-group.json \
| jq .
update-group.json
:
{
"schemas": [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ],
"Operations": [
{
"op": "add",
"path": "roles",
"value": [
{
"value": "group_manager"
}
]
}
]
}
Log in to the Account Console:
Select the Group:
Grant Access:
10-31-2024 08:41 AM
Thanks @NandiniN, good to know about using the API to assign group managers.
What we've been unable to figure out is how a group manager can actually add or remove members from the group they are a manager of? We haven't been able to get anything to work without the manager also being a Workspace admin, which is not what we want.
10-31-2024 11:10 AM
I see, I was the admin.
Group managers who are not workspace admins can manage group roles using the Accounts Access Control API. This allows them to add or remove members from the group they manage.
mentioned here - https://learn.microsoft.com/en-us/azure/databricks/admin/users-groups/groups#who-can-manage-account-..., https://learn.microsoft.com/en-us/azure/databricks/admin/users-groups/groups#manage-group-roles-api
{workspace-domain}/api/2.0/preview/accounts/access-control/assignable-roles
.https://docs.databricks.com/api/azure/account/accountaccesscontrolHope this helps?
11-01-2024 05:20 AM
thanks @NandiniN ,
we have looked through that documentation and still have not been able to get anything to work without the user also being an account or workspace admin. The way i'm interpreting the documentation (screenshot) is the API currently only supports assigning a user a role (i.e. the Group Manager), but does not allow for adding or removing users from the group. When trying to patch we get error messages like "Members attribute cannot be updated as group newgroup can only be managed in account."
Hoping to hear if/when Databricks plans to support this?
Join a Regional User Group to connect with local Databricks users. Events will be happening in your city, and you won’t want to miss the chance to attend and share knowledge.
If there isn’t a group near you, start one and help create a community that brings people together.
Request a New Group