@dean james​ I am not sure about your case why you want to deny access to the group once you create it. Anyhow, we can use deacticate/activate an user using "2.0/preview/scim/v2/Users/{id}" rest API endpoint. We can also deactivate users that have not logged in for a customizable period. Hope this helps

https://docs.databricks.com/dev-tools/api/latest/scim/scim-users.html#activate-and-deactivate-user-b...

https://docs.databricks.com/dev-tools/api/latest/scim/scim-users.html#automatically-deactivate-users