SCIM API shows only databricks-sql-access,but Workspace Access is still displayed (grayed out) in UI

Sainath368
Contributor

3 weeks ago

Hi Team,

I'm testing Databricks entitlement automation using the Workspace Groups SCIM API.

I have an Entra ID group that is synchronized to the Databricks Account via SCIM. I'm using a Service Principal authentication to manage workspace-level entitlements through the SCIM Groups API.

I patched the group with the following entitlement:

Sainath368_0-1784035197931.png

When I retrieve the group through the SCIM API, I get the following response:
Sainath368_1-1784035230093.png

Based on the API response, it appears that the group has only databricks-sql-access assigned directly.

However, in the Databricks workspace UI under:

Settings → Identity and Access → Groups → Group01

I see:

  • Workspace Access = Enabled (grayed out)
  • Databricks SQL Access = Enabled

Since Workspace Access is grayed out, it looks like it may be inherited. However, the SCIM API response shows "groups": [], which suggests the group is not a member of another parent group.

My questions are:

  1. Does the SCIM API return only directly assigned entitlements while the UI shows both direct and inherited entitlements?
  2. If Workspace Access is inherited, how can I determine the source of inheritance when the group's groups attribute is empty?
  3. What is considered the source of truth for entitlement automation—the SCIM API response or the workspace UI?

I'm trying to build automation to onboard groups to workspaces and manage entitlements through JSON-driven configuration, so I want to ensure I correctly understand the entitlement model before proceeding.

Thanks in advance for any guidance.

Labels:
0 Kudos