On-behalf-of token creation for service principals is not enabled for this workspace

[Ajay-Pandey]

Hi All

I just wanted to create PAT for Databricks Service Principle but getting below code while hitting API or using CLI - 

Please help me to create PAT for the same.

#dataengineering #databricks

[Kaniz_Fatma]

Hi @Ajay-Pandey, Please check this community thread -

• https://databricks.my.site.com/forums/s/question/0D58Y0000A3xFIeSQM/not-able-to-generate-access-toke...

[Ajay-Pandey]

@Kaniz_Fatma I have already referred this one but still having issue
I have created Service Account in Databricks and I am not using Azure Service Principle

[Kaniz_Fatma]

Hi @Ajay-Pandey, The error message you’re encountering indicates that the on-behalf-of token creation feature for service principals is not enabled for your Databricks workspace.

To enable this feature, follow these steps:

1. Provide CAN_USE Permission:

   • You need to grant the CAN_USE permission to the service principal in the token manage permission.
   • Navigate to Admin > Workspace Settings.
   • Look for the CAN_USE option and provide this permission to your service principal.
2. Once the feature is enabled, you should be able to use the /api/2.0/token-management/on-behalf-of/to...¹². If you encounter any further issues, feel free to reach out for assistance! 

[Ajay-Pandey]

Hi @Kaniz_Fatma ,

I have given all the permissions (Admin) to Service Principle and still having the same issue.

Please find all the details below - 

[Ajay-Pandey]

Hi @Kaniz_Fatma 
Have you got any update on this ?

[MorpheusGoGo]

This only works if you are on AWS or GCP, no support for Azure 😞 

Check the API documentation AWS - https://docs.databricks.com/api/workspace/tokenmanagement/createobotoken

No such documentation exists for Azure.