UI sends empty managed_identity_id, breaks storage credential creation with system-assigned Access

Nimanita
New Contributor II

2 weeks ago - last edited 2 weeks ago

Environment:

  • Cloud: Azure
  • Databricks Account Console (accounts.azuredatabricks.net)
  • Access Connector: system-assigned managed identity (no user-assigned identity involved)
  • Region: East US

Issue:

Creating a Unity Catalog storage credential via the Account Console UI, using an Access Connector with a system-assigned managed identity, fails with:

 
BAD_REQUEST: Azure Managed Identity Credential with Access Connector Id <id>and Managed Identity ID:  for Account Id: <account-id> could not be found.

Root cause:

Checked the network tab — the UI sends:

 
json
"azure_managed_identity": {
  "access_connector_id": "<connector-id>",
  "managed_identity_id": ""
}

For system-assigned identities, managed_identity_id shouldn't be sent at all (per Databricks docs). The backend seems to treat the empty string as "look up this identity," fails, and returns a misleading error blaming the connector.

Proof it's UI-side, not config:

Everything on Azure was verified correct (connector exists, region matches, RBAC correct, waited 1hr+ for propagation, tested with a proper Global Admin account). Running the same request via CLI, omitting managed_identity_id entirely, worked on the first try — same connector, same subscription, no Azure-side changes.

 
bash
databricks account storage-credentials create <metastore-id> --json '{  "credential_info": {    "name": "cred",    "azure_managed_identity": {"access_connector_id": "<connector-id>"}  }}'

Is this a known bug in the Account Console UI for system-assigned Access Connectors? 

Labels:

iyashk-DB
Databricks Employee
Databricks Employee

2 weeks ago

Yes, this is a bug in the Account Console UI. You've already diagnosed it correctly: for a system-assigned managed identity, managed_identity_id should be omitted entirely from the request payload. An empty string "" is not the same as omitting the field, and the backend rejects it.

Your CLI workaround is the right approach. The Databricks CLI correctly omits managed_identity_id when you don't supply one, which is why it works without any changes on the Azure side. The UI is incorrectly serializing the field as an empty string instead of leaving it out.

For others hitting this: create the storage credential via the CLI like this:

databricks storage-credentials create \
  --name my-storage-credential \
  --az-mi-access-connector-id \
/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Databricks/accessConnectors/<connector-name>

No --az-mi-managed-identity-id flag for system-assigned. That omission is intentional.

You should report this to Databricks support so the UI bug gets tracked and fixed. Include the network trace showing the empty managed_identity_id field in the payload -- that's solid evidence.

View solution in original post

Chaitanya1905
New Contributor II

a week ago

Thanks for pointing me in the right direction! That was indeed the issue.

For anyone else who runs into the same problem, here's what worked for me using the Databricks Account CLI.

1. Install Databricks CLI

winget install Databricks.DatabricksCLI

2. Login to the workspace

databricks auth login --host https://adb-<workspace-id>.<region>.azuredatabricks.net

3. Login to the Databricks Account

databricks auth login --host https://accounts.azuredatabricks.net --account-id <account-id> --profile AccountAdmin

4. Verify the profiles

databricks auth profiles

5. Get the Metastore ID

databricks account metastores list --profile AccountAdmin

6. Create the Storage Credential

databricks account storage-credentials create <metastore-id> --json @credential.json --profile AccountAdmin

credential.json

{
  "credential_info": {
    "name": "poc-storage-credential",
    "azure_managed_identity": {
      "access_connector_id": "<access-connector-resource-id>"
    }
  }
}

7. Verify the Storage Credential

databricks account storage-credentials list <metastore-id> --profile AccountAdmin

Copy the Storage Credential ID.

8. Update the Metastore

databricks account metastores update <metastore-id> --json @update-metastore.json --profile AccountAdmin

update-metastore.json

{
  "metastore_info": {
    "storage_root_credential_id": "<storage-credential-id>"
  }
}

9. Verify the Metastore

databricks account metastores get <metastore-id> --profile AccountAdmin

Verify that these fields are present:

  • storage_root_credential_id

  • storage_root_credential_name

  • default_data_access_config_id

After that, I was able to create catalogs, schemas, and managed Delta tables successfully.

Hopefully this helps anyone else who runs into the same issue. Thanks again for identifying the UI bug and suggesting the CLI workaround! @iyashk-DB 

camit001
New Contributor
In response to Chaitanya1905

Thursday

Thanks for sharing the detailed workaround! This is incredibly helpful.

Your step-by-step CLI approach makes it much easier to understand how to configure the storage credential and update the metastore when the UI doesn't expose the required option. The verification steps at the end are especially useful for confirming everything is configured correctly.

I'm sure this will save others a lot of time if they encounter the same issue. Really appreciate you taking the time to document the complete solution!

0 Kudos