Thanks a lot LR for the detailed breakdown!

This was very helpful in narrowing things down. I’ve walked through the checks you outlined and wanted to share what I’m seeing so far:

• Networking / AKV Firewall
• Based on discussions with our network team, temporarily enabling “Allow public access from all networks” requires a policy exemption, so we haven’t been able to test that path yet.
• But we did add the Databricks control plane IPs for East US to the Key Vault firewall.
• “Allow trusted Microsoft services to bypass this firewall” is already enabled.
• The workspace is SCC-enabled:
• How do we correctly allowlist the SCC-related domains/endpoints in the Key Vault firewall? Saw mentions of Service Tags in the MS docs but was not sure if there was an explicit step/way to add domains yet.
• 

   

• 
• Permissions Model:
• Confirmed that the Key Vault is using Vault Access Policy mode (not RBAC).
• CLI Attempt (userAADToken error)
• I tried creating the scope via CLI, but I’m hitting:

Error: Scope with Azure KeyVault must have userAADToken defined!

• Using this json config:

{
  "scope": "scope_name",
  "initial_manage_principal": "users",
  "scope_backend_type": "AZURE_KEYVAULT",
  "backend_azure_keyvault": {
    "resource_id": "/subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.KeyVault/vaults/<VAULT_NAME>",
    "dns_name": "https://<VAULT_NAME>.vault.azure.net/"
  }
}

• I found this KB article addressing the issue, but I’m not fully clear on implementing it yet.
• https://kb.databricks.com/security/creating-an-azure-key-vault-backed-secret-scope-with-the-databric....
• Would you have pointers/advice on what would be the implementation steps needed or how we could resolve the error observed with may be another approach.
• AzureDatabricks SP
• Confirmed that the AzureDatabricks enterprise application exists in our tenant and the App ID matches.

Appreciate the direction so far. It definitely helped isolate this further!

Thanks,