Azure Databricks Workspace: Users are being added to the admins group on their own

If users in your Azure Databricks workspace are being automatically added to the admin group without any direct action, the issue may be linked to SCIM provisioning or other group management settings.

First step to verify is to check if the SCIM provisioning configuration in Microsoft Entra ID does not include rules or mappings that automatically place certain security group members into the Databricks admin group.

You may have some nested groups that are being synchronized. If a nested group that contains users is provisioned as part of an admin group, its members may be included automatically.

With Unity Catalog, users and groups can inherit privileges based on catalog configurations so try that there are no catalog-wide settings that automatically promote certain user groups or specific roles to admin privileges.

Have you checked also if there are custom sync rules or scripts in Microsoft Entra ID that trigger user promotions based on specific attributes or conditions ?

One last thing, if you are using any third-party identity management tools or systems that may have access to both Azure Databricks and Microsoft Entra ID, keep in mind that these tools could be orchestrating changes based on predefined roles or permissions.