azure databricks automatic user provisioning via terraform

oktarinet
New Contributor II

‎05-12-2025 08:37 AM

Hi community, 

Azure databricks recently announced a new user management feature (now in public preview) called automatic-identity-management , which allows Azure databricks to access Azure Entra ID directly and grant users and groups permissions and roles in Databricks directly, without needing a SCIM provisioning application.

I have enabled this feature and have successfully provisioned test users into my workspace. However, I have not been successful at configuring this through Terraform.
Here is some code I have attempted:

resource "databricks_group" "test" {
  display_name         = "auto-provisioning-test"
  allow_cluster_create = true
  workspace_access     = true
}
data "azuread_group" "test" {
  display_name = "SGA_DATABRICKS_Test" # Entra group
}

resource "databricks_group_member" "test" {
  group_id  = databricks_group.test.id
  member_id = data.azuread_group.test.object_id
}

I also tried

data "databricks_group" "test" {
  display_name = "SGA_DATABRICKS_Test" # Entra group
}

But both attempts gave me a "Error: cannot read group member: Group has no member" error.

Is there a correct way to do this?

Labels:
0 Kudos

oktarinet
New Contributor II

‎05-16-2025 02:00 AM

see https://github.com/databricks/terraform-provider-databricks/issues/4687#issuecomment-2875157936

0 Kudos

saurabh18cs
Honored Contributor III

‎05-16-2025 03:16 AM

Hi , I think 

  • The automatic identity management feature provisions Azure Entra ID users and groups directly into Databricks. However, Terraform's databricks_group and databricks_group_member resources are designed for managing groups and memberships within Databricks, not for managing Azure Entra ID groups directly.
  • The error Group has no member occurs because the databricks_group resource is trying to manage a group that is already being managed by Azure Entra ID through automatic provisioning.