Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

[ahsan_aj]

Hi all,

I am using the Azure Databricks Microsoft Managed Enterprise Application scope (2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/user_impersonation) to fetch an access token on behalf of a user. The authentication process is successful; however, the access token includes group claims. For users who are part of many Azure AD groups, the token becomes quite large because it lists all the groups in the claims. How can I modify my request for the token to exclude group claims from the access token?

I am using the React MSAL library, and here’s a sample of the code I am working with:

export const getDatabricksToken = async () => {
    const account = msalInstance.getActiveAccount();
    const response = await msalInstance.acquireTokenSilent({
        scopes: ["2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/user_impersonation"],
        account: account,
    })
    return response.accessToken
};

[skraszki]

Hi, did you find an answer for it?

[ahsan_aj]

I got in touch with Microsoft support and they mentioned it is not possible as the Azure Databricks app registration is managed by Databricks and changing the manifest to exclude group claims on that application is not possible and it impacts all users.

[Alberto_Umana]

Hi @ahsan_aj,

You can modify your token request by adding a claims parameter

    const claimsRequest = {

        "access_token": {

            "groups": null

        }

https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-role...

[ahsan_aj]

Let me try this and get back to you.

[ahsan_aj]

I tried it like this, however it still adds group claims in the access token:

export const getDatabricksToken = async () => {
    const account = msalInstance.getActiveAccount();
    const response = await msalInstance.acquireTokenSilent({
        scopes: ["2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/user_impersonation"],
        account: account,
        claims: JSON.stringify({
            "access_token": {
                "groups": null
            }
        })        
    })
    return response.accessToken
};