How do I assign managed identity to a databricks resource?

Alexa Kiss 0 Microsoft Employee

I have created a linked service from ADF to Databricks cluster, following https://techcommunity.microsoft.com/t5/azure-data-factory-blog/azure-databricks-activities-now-support-managed-identity/ba-p/1922818

I have provided contributor access to the ADF managed identity on ADB. The identity is visible in Databricks workspace among "Service principals"

the following code

from azure.identity import ManagedIdentityCredential

credential = ManagedIdentityCredential(client_id=<ADF_MI_client_ID>) 
# Attempt to get a token to verify the credential
token = credential.get_token('https://management.azure.com/.default')

raises error

ImdsCredential.get_token failed: ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource. Error: Unexpected response "{'error': 'invalid_request', 'error_description': 'Identity not found'}" ManagedIdentityCredential.get_token failed: ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource. Error: Unexpected response "{'error': 'invalid_request', 'error_description': 'Identity not found'}"CredentialUnavailableError: ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource. Error: Unexpected response "{'error': 'invalid_request', 'error_description': 'Identity not found'}"

File /local_disk0/.ephemeral_nfs/envs/pythonEnv-dee10191-2736-4bc4-8d19-2d7544b07fa7/lib/python3.10/site-packages/azure/identity/_credentials/imds.py:101, in ImdsCredential._request_token(self, *scopes, **kwargs) 100 try: --> 101 token = self._client.request_token(*scopes, headers={"Metadata": "true"}) 102 except HttpResponseError as ex: 103 # 400 in response to a token request indicates managed identity is disabled, 104 # or the identity with the specified client_id is not available

PRADEEPCHEEKATLA-MSFT 84,381 Reputation points Microsoft Employee

2024-06-13T03:52:53.0966667+00:00
@Alexa Kiss - Thanks for the question and using MS Q&A platform.

Could you please provide more details on your ask?

As per the document referred, are you not able to assign managed identity to databricks resource?

Where exactly are you running the following code?

Are you experiencing any error message while execute the code? If yes, please do share the complete stack trace of the error message along with the screenshot?

Looking forward for your response.
Alexa Kiss 0 Reputation points Microsoft Employee

2024-06-13T04:42:49.3833333+00:00

Thank you for your response, somehow my message was not fully sent.

I have corrected my first message, please see error details.
the linked service connection I have assigned to this dedicated cluster. The Databricks workflow is successfully triggered from ADF pipeline, but runs into above error.
I am running the code in a databricks pyspark notebook, cluster is the following
PRADEEPCHEEKATLA-MSFT 84,381 Reputation points Microsoft Employee

2024-06-14T06:47:45.2166667+00:00

@Alexa Kiss - The error message suggests that the managed identity you are trying to use has not been assigned to the resource you are trying to access.

To resolve this issue, you can try the following steps:

Verify that the managed identity has been assigned the correct role (in your case, "Contributor") on the Azure Databricks resource. You can do this by navigating to the Azure Databricks workspace in the Azure portal, clicking on "Access Control (IAM)", and checking the role assignments for the managed identity.

Ensure that the managed identity is correctly specified in your code. Double-check that the client ID you are using matches the client ID of the managed identity you have assigned to the Azure Databricks resource.

If you have recently assigned the managed identity to the Azure Databricks resource, it may take a few minutes for the changes to propagate. Wait a few minutes and try again.

If none of these steps resolve the issue, please let me know and we can explore other possible solutions.
Alexa Kiss 0 Reputation points Microsoft Employee

2024-06-16T11:46:57.8866667+00:00

Thank you for your response!
the data factory's system assigned managed identity has contributor role on Databricks

I have also double-checked the client id for correctness.

Still getting the same error.
Alexa Kiss 0 Reputation points Microsoft Employee

2024-06-16T11:49:33.52+00:00

Note that I have also tried to add user-assigned managed identity to the databricks VM, but as it is part of the managed resource group, I assume we do not have the permissions to modify identites

I get this message:
..." has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions..... However, the access is denied because of the deny assignment with name 'System deny assignment created by Azure Databricks"
PRADEEPCHEEKATLA-MSFT 84,381 Reputation points Microsoft Employee

2024-06-17T04:33:10.96+00:00

@Alexa Kiss - Regarding your error message, it seems that there is a deny assignment in place that is preventing you from modifying identities. This could be default policy to deny assignment on any modification done on the managed resource group created by Azure Databricks.

Note: You are not allowed to modify the resources on the managed resource group created by Azure Databricks.

Hope this helps. Do let us know if you any further queries.
Alexa Kiss 0 Reputation points Microsoft Employee

2024-06-17T05:56:27.4+00:00

Thank you for the response.
Would the same policy prevent me to associate the managed identity of the ADF with Databricks resource or can there be another reason?
PRADEEPCHEEKATLA-MSFT 84,381 Reputation points Microsoft Employee

2024-06-18T05:45:57.9033333+00:00

@Alexa Kiss - Note the managed identity is not prevented by the associated policy.

I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?

Share via

How do I assign managed identity to a databricks resource?