Thank you, @szymon_dybczak. This is what I thought. After deploying the Databricks workspace, it automatically creates the Databricks managed `Access Connector for Azure Databricks` in the Databricks managed resource group.

As I understand, I should create Storage Credential refers to the Databricks managed `Access Connector for Azure Databricks`, then create External Location. After that, I can create Unity Catalog managed tables and volumes.

However, because I would want to use Terraform and Azure Managed (Microsoft Entra ID) service principal to create the Storage Credential, I need to assign Contributor role of the Databricks managed `Access Connector for Azure Databricks` to the service principal. But I cannot assign any role of the Databricks managed `Access Connector for Azure Databricks` because of the Deny Assignment rule.

Therefore, as you suggest, now I create my own `Access Connector for Azure Databricks`.

However, if so, what is the point of having the Databricks managed `Access Connector for Azure Databricks` 😂