Thank you, Stefan-Koch. Your solution works.

Interesting, the document mentions:

I thought the targe identity indicates the service principal, and I have added the service principal to the databricks workspace. However, either my understanding is wrong, or the document is incorrect.