Deny assignment modification to allow attach/detach of disks in azure databricks

[Lucidity]

Our application does storage autoscaling on Azure. We would like to deploy our solution with Azure databricks. But even though the service principal associated with our application has the necessary roles and permissions to attach/detach a disk from a VM, its unable to do because of the deny assignment created by databricks on azure. Is there a way to modify the deny assignment or get the service principal associated with our appplication in the exludePrincipal section of the deny assignment.

If this is not possible, does databricks itself provides api's to attach / detach a disk from a VM

[Ayushi_Suthar · Accepted solution]

Hi @Lucidity , Thanks for bringing up your concerns, always happy to help 😁

According to the provided information, it seems that you are attempting to modify the disk resources. However, access is being denied due to a deny assignment. This denial is occurring because the resources are within a managed resource group (MRG). When attempting to make changes to a managed resource group or its associated resources, users encounter system deny assignment errors.

Under a managed resource group, users have restricted access. These MRGs are established during workspace creation and are under the control of Databricks management. No alterations or modifications can be applied to the MRG itself or the resources within it.

Please refer this document for the more details: https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments

Please let me know if this helps and leave a like if this helps, followups are appreciated.
Kudos
Ayushi

[Lucidity]

Thank you for your reply

Is there any way databricks provides to bypass the deny assignment for specific apps? I noticed in the deny assignment unity-catalog-access-connector has been provided exlusion under the excludePrincipals section. is there a way to get our application also excluded from the deny assignment?

Are you aware of any API's databricks provides to attach / detach disks from a VM part of databricks cluster part of managed resource group?


Apart from this, would be really helpful if you can suggest any other alternatives

thanks