How to give permission to workspace level group on databricks catalog

Question

How to give permission to workspace level group on databricks catalog

Koteswara Pushadapu 0

Hi All,
Using automation we are creating databricks components those are required for the SAAS customer.

As part of this we are able to create the following components.

External Location
Catalog (Volumes, Schemas and Tables)
Jobs
Customer Groups at Workspace level ( Not Account Level)
Warehouse Computes
Repo folder

We are looking option to give catalog access to this customer specific group so that they can access with out any issue.

We tried in multiple ways the same but failing. Here is the error

[RequestId=96bb2f59-1801-445c-b5f7-38db70da1aca ErrorClass=PRINCIPAL_DOES_NOT_EXIST.PRINCIPAL_DOES_NOT_EXIST] Could not find principal with name koti74_admin_grp.

Request you suggest if we are doing something wrong. We are strongly believing that we can use workspace level groups for these components.

Moved from: Community Center | Discuss the Q&A site | Get started on Q&A

Koteswara Pushadapu 0 Reputation points

2025-12-11T03:07:25.9833333+00:00

Thanks for the reply Manoj Kumar.
What is the importance of worksapce level groups? Basically we don't want to go with Account level groups because of that group exists at account level and may get access to multiple workspaces under the same account. We are not looking for this.
It will be great if possible to get the same with out account level group.
Regards
Koti
Manoj Kumar Boyini 1,735 Reputation points Microsoft External Staff Moderator

2025-12-11T10:30:41.1866667+00:00
Hi Koteswara Pushadapu,

I completely understand your concern you don’t want to use account-level groups because they might automatically gain access to all workspaces. This is a very valid concern in multi-tenant SaaS setups.

Account-level groups do not automatically get access to anything
An account-level group simply exists at the account level. It only gets access to a workspace or to Unity Catalog if you explicitly assign it.

So you stay in full control:

If you create customer_acme_group at the account level,

And only add it to the ACME workspace,

Then it will never have access to any other workspace or catalog unless you grant it.

No cross-tenant leakage. No accidental workspace permissions. No shared access.

Why workspace-level groups don't work for Unity Catalog
Unity Catalog only recognizes account-level identities (Account Console or Entra ID sync). Workspace-local groups are invisible to UC, which is why you're seeing: PRINCIPAL_DOES_NOT_EXIST

This is a platform limitation UC simply cannot grant catalog/schema/table permissions to workspace-only groups.

You have two options:

Option 1: Account-level groups (Recommended)

Create one account-level group per customer, Add it only to that customer's workspace, Grant UC permissions to that group, Perfect isolation, no cross-workspace access

Option 2: Entra ID groups (Even better for SaaS)

Create one Entra ID group per customer, Enable SCIM sync → automatically appears in Databricks, Grant UC permissions to that group, Single source of truth, automatic sync, perfect isolation

Reassurance:
Using account-level groups does not expose them to other workspaces. They do not automatically get UC permissions either. You choose exactly where they appear and what they can access.

Helpful References:
https://docs.databricks.com/aws/en/admin/users-groups/groups
https://dori-uw-1.kuma-moon.com/en-us/azure/databricks/data-governance/unity-catalog/manage-privileges/
https://docs.databricks.com/aws/en/admin/users-groups/scim/aad
https://dori-uw-1.kuma-moon.com/en-us/azure/databricks/admin/users-groups/scim/
https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control
https://community.databricks.com/t5/administration-architecture/account-level-groups/td-p/119902

Hope this helps, Please let us know if you have any questions and concerns.
Koteswara Pushadapu 0 Reputation points

2025-12-11T12:30:51.6566667+00:00

Thanks Manoj Kumar.
It is clear now. Superb.
Manoj Kumar Boyini 1,735 Reputation points Microsoft External Staff Moderator

2025-12-11T12:47:58.22+00:00

Hi Koteswara Pushadapu,

Thank you for the update! I’m glad it helped. If the answer resolved your issue, please consider accepting it so it can benefit other community members.

Answer accepted by question author

1 additional answer

Your answer

Koteswara Pushadapu 0 Reputation points

2025-12-11T03:07:25.9833333+00:00

Thanks for the reply Manoj Kumar.
What is the importance of worksapce level groups? Basically we don't want to go with Account level groups because of that group exists at account level and may get access to multiple workspaces under the same account. We are not looking for this.
It will be great if possible to get the same with out account level group.
Regards
Koti
Koteswara Pushadapu 0 Reputation points

2025-12-11T12:30:51.6566667+00:00

Thanks Manoj Kumar.
It is clear now. Superb.
Manoj Kumar Boyini 1,735 Reputation points Microsoft External Staff Moderator

2025-12-11T12:47:58.22+00:00

Hi Koteswara Pushadapu,

Thank you for the update! I’m glad it helped. If the answer resolved your issue, please consider accepting it so it can benefit other community members.

Answer 1

Hi Koteswara Pushadapu,

The error PRINCIPAL_DOES_NOT_EXIST: Could not find principal with name koti74_admin_grp occurs because Unity Catalog does not recognize workspace-level groups.

Even though the group exists inside the Databricks workspace, Unity Catalog only supports account-level identities (from Databricks Account Console or Entra ID sync). Workspace-local groups cannot be assigned catalog, schema, table, volume, or external location permissions.

Unity Catalog checks the metastore’s identity store (account level). Workspace groups do not exist there → so the GRANT command fails with PRINCIPAL_DOES_NOT_EXIST.

Go to Databricks Account Console → User Management → Groups
Create group koti74_admin_grp, add members, retry the permission grant

GRANT USE CATALOG ON CATALOG <catalog_name> TO `koti74_admin_grp`;

This will now work because the principal exists at the UC level.

Option 2 :Use Entra ID groups with SCIM sync

If you are provisioning customers automatically:

Create AAD group: koti74_admin_grp, Ensure SCIM provisioning is enabled for your workspace, After sync, grant UC permissions:

GRANT USE CATALOG ON CATALOG <catalog_name> TO `koti74_admin_grp`;

This is the best method for multi-tenant SaaS automation.

Hope this helps, Please let us know if you have any questions and concerns

Answer 2

To grant permissions to a workspace-level group on a Databricks catalog, you need to ensure that the group exists and is correctly referenced. The error message you are encountering, PRINCIPAL_DOES_NOT_EXIST, indicates that the specified group (koti74_admin_grp) cannot be found. Here are some steps to troubleshoot and ensure proper access:

Verify Group Existence: Ensure that the workspace-level group koti74_admin_grp has been created successfully in your Databricks workspace. You can check this in the user management section of the Databricks workspace.
Correct Group Reference: When assigning permissions, make sure you are using the exact name of the group as it appears in Databricks. Any discrepancies in the name will lead to the error you are seeing.
Assign Permissions: Once you have verified the group exists and is correctly referenced, you can assign permissions to the catalog. This typically involves using the Unity Catalog privileges and securable objects management features. You can grant the group the necessary privileges by navigating to the catalog settings and assigning the appropriate access level to koti74_admin_grp.
Use Account Groups: If you continue to face issues with workspace-level groups, consider migrating to account-level groups, as they are more flexible and can be used across multiple workspaces. This might require some adjustments in your automation scripts.
Check Documentation: For detailed steps on managing permissions and groups, refer to the Databricks documentation on identity management and permissions.

If you follow these steps and still encounter issues, you may want to reach out to Databricks support for further assistance.

References:

Share via

How to give permission to workspace level group on databricks catalog

1 additional answer

Your answer