Thanks - think we were originally overthinking this.

We determined we were doing this correctly, the user just needed to switch to 'groups' within PIM to request elevation of permissions.  The larger issue is actually the 40 min user provisioning cycle as DataBricks does not pick up the change until this runs.  This may be an option long-term, but the User Provisioning delay is making this a no go for our team.