Service Principal with Federated Credentials Can’t Access Full Repo in ADO

PearceR
New Contributor III

Good Afternoon,

I’m using Databricks with Git integration to Azure DevOps (ADO).

  • Authentication is via Microsoft Entra federated credentials for a service principal (SPN).
  • The SPN has Basic access in ADO, is in the same project groups as my user, and Git integration is configured successfully.
  • When I run jobs as my user, the entire repo is accessible.
  • When I run jobs as the SPN, only the entry file specified in the job runs; other files in the repo are not accessible.
  • The job source is set to a branch, not a single file.

Why does the SPN only get access to the entry file and not the full repo? Is this expected behavior for Git source jobs, or am I missing a configuration step to allow full repo checkout when using a service principal? Has anyone else experienced similar issues?

I followed steps outlined here: Use a Microsoft Entra service principal for automation with Azure Databricks Git folders - Azure Dat...

from this release: OAuth 2.0 Git credential support for Service Principals is now Generally Available | Databricks Blog

Thanks for reading!