Use an Azure AD service principal as compute ACL

Create an Azure AD service principal and use it for access control.

Written by venkatasai.vanaparthi

Last published at: December 21st, 2022

When granting permissions to a compute cluster (compute access control), it is possible to grant permission to the following entities:

  • Users
  • Groups
  • Service principals (Azure only) 


Before you can use compute access control, an administrator must enable it for the workspace. Review Enable cluster access control for your workspace for more information. You should also ensure you meet the requirements to use SCIM API 2.0 (ServicePrincipals).


Create a service principal and add it to your workspace

Option 1:

Follow the Add service principal API documentation to create a service principal and add it to your workspace.

Option 2: 

Run this example code in a notebook.


curl --location --request POST 'https://<databricks-instance>/api/2.0/preview/scim/v2/ServicePrincipals'; \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{

Replace the following values before running the example code:

  • <access-token> - Your Azure Databricks personal access token. If you do not have an access token, you will have to create one.
  • <azure-application-id> - The Azure application ID of the service principal, for example 12345a67-xxx-0d1e-23fa-4567b89cde01.
  • <databricks-instance> - The workspace instance name, for example
  • <display-name> - The display name of the service principal, for example

Add the service principal to your compute ACL

After the service principal has been added to your workspace, you have to add it to your compute.

  1. Click Compute in the left menu bar.
  2. Click the name of your compute cluster.
  3. Click More.
    More button expanded with Permissions highlighted.
  4. Click Permissions.
  5. Click the Select User, Group or Service Principal drop-down.Permission settings menu listing users and permissions.
  6. Select the service principal you created in the previous step.Selecting a service principal from the user list.
  7. Select the permission to assign to the service principal (ex. Can Read, Can Manage).
  8. Click +Add.
  9. Click Save.
  10. Click More.
    More button expanded with Restart highlighted.
  11. Click Restart.
  12. Click Confirm to restart the compute cluster.

Was this article helpful?