Databricks SCIM provisioning from Google Workspace

Databricks supports account-level SCIM provisioning on the Premium plan and above. An account admin enables user provisioning in the account console, which issues a SCIM token and an Account SCIM URL. AnySCIM uses them to create Databricks users from Google Workspace, sync Google groups to account groups and deactivate people across every workspace when they leave.

Requirements

• A Databricks account on the Premium plan or above.
• A Databricks account admin.
• Workspaces enabled for identity federation, so you can assign account groups to workspaces.
• SSO is recommended before you enable provisioning. Google Workspace can be the identity provider through a custom SAML app.

Get the SCIM token and URL

1. Sign in to the Databricks account console as an account admin.
2. In the sidebar, click Security, then open the Identity provider setup tab.
3. In Identity management, click Enable user provisioning.
4. Copy the SCIM token and the Account SCIM URL.

Connect Databricks in AnySCIM

1. Open Connections → New connection and choose Databricks.
2. Replace the pre-filled base URL with the Account SCIM URL you copied. On AWS it looks like https://accounts.cloud.databricks.com/api/2.0/accounts/{account_id}/scim/v2; other clouds use their own host.
3. Paste the token and click Test connection.
4. In Scope, select who should have Databricks. Turn on Push group membership to create Databricks account groups from Google groups.
5. Review the dry-run and activate.

How users are synced

• New users in scope are created at the account level, matched by email. A user who already exists with the same email is merged, not duplicated.
• Google groups become Databricks account groups. Databricks' SCIM API doesn't support nested groups, but AnySCIM expands nested Google groups first, so each account group contains every effective member.
• Assign account groups to workspaces in Databricks: workspace access then follows Google group membership.
• When a Google user is suspended, AnySCIM sets active: false, which deactivates the user in the account and in all of their workspaces.

Troubleshooting

• Users exist but can't open a workspace: they have no workspace assignment. Assign their account group to the workspace, and check that the workspace has identity federation enabled.
• Workspace-level SCIM is also configured: that connector is legacy. Disable it once the account-level connection is running, but don't remove users from it first: that would deactivate them in the workspace.
• Entitlements come back after you remove them: attributes from the identity provider override manual changes at the next sync. Manage access through groups instead.
• Limits: an account can hold up to 10,000 users and service principals combined, and 5,000 groups. Service principals aren't managed through SCIM.

FAQ

Does Databricks support SCIM with Google Workspace?

Databricks documents connectors for Microsoft Entra ID, Okta and OneLogin. Its account-level SCIM API works with any SCIM client using the token from the account console, so AnySCIM can connect Google Workspace to it.

Should I use account-level or workspace-level SCIM?

Account-level. Databricks treats workspace-level SCIM as legacy: one account-level connection covers every workspace with identity federation enabled.

What happens when someone leaves the company?

When their Google account is suspended, AnySCIM sends active: false at the next sync and Databricks deactivates them in the account and in every workspace they had access to.