How can I get workspace groups and their users via a table — and also from a Databricks App?

[discuss_darende]

I’m trying to get a full list of Databricks workspace groups and their user memberships. I want to do this in two ways:

1. As a queryable table or view (e.g., for audits, security reviews, app integration)

2. From within a Databricks App (Streamlit-style), using Python (SDK or SQL)
   
   I see information about system.access.users table but can't see the table, if it's not enabled in the system is it possible to enable later or what other options do I have to get the group.

To be more spesific as an admin when I create a group in workspace such as 'project-users' assign that group user1@email.com and give read access to that group. I want to be able to get the information as a table instead of checking the databricks UI.

[Raman_Unifeye · Accepted solution]

@discuss_darende - you could use below code in the notebook.

Pls adjust it based on your need.

from databricks.sdk import AccountClient, WorkspaceClient

# If env vars are set, this picks them up automatically
a = WorkspaceClient()

# List identities
users = list(a.users.list())
groups = list(a.groups.list())
service_principals = list(a.service_principals.list())

print(f"Users: {len(users)}")
for u in users[:10]:
    print(f"- {u.user_name}")

print(f"\nGroups: {len(groups)}")
for g in groups[:10]:
    print(f"- {g.display_name}")

print(f"\nService Principals: {len(service_principals)}")
for sp in service_principals[:10]:
    print(f"- {getattr(sp, 'display_name', getattr(sp, 'application_id', 'unknown'))}")


def get_group_members_by_id(group_id: str):
    w = WorkspaceClient()
    group = w.groups.get(id=group_id)  # SCIM read of the group
    members = group.members or []
    return members

# List users and service principals in each group
for group in a.groups.list():
    print(f"Group: {group.display_name}")
    members = list(get_group_members_by_id(group.id))
    for member in members:
        print(f"  - {member.type}: {getattr(member, 'display', getattr(member, 'user_name', 'unknown'))}")

[discuss_darende]

Is there a way to make this work for a Databricks App? A service principal would likely get stuck during authentication when connecting. My main goal is to retrieve this information and present it in the app—do you think this is possible