Yes, this is a bug in the Account Console UI. You've already diagnosed it correctly: for a system-assigned managed identity, managed_identity_id should be omitted entirely from the request payload. An empty string "" is not the same as omitting the field, and the backend rejects it.

Your CLI workaround is the right approach. The Databricks CLI correctly omits managed_identity_id when you don't supply one, which is why it works without any changes on the Azure side. The UI is incorrectly serializing the field as an empty string instead of leaving it out.

For others hitting this: create the storage credential via the CLI like this:

databricks storage-credentials create \
  --name my-storage-credential \
  --az-mi-access-connector-id \
/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Databricks/accessConnectors/<connector-name>

No --az-mi-managed-identity-id flag for system-assigned. That omission is intentional.

You should report this to Databricks support so the UI bug gets tracked and fixed. Include the network trace showing the empty managed_identity_id field in the payload -- that's solid evidence.