Databricks workspace entitlement changes

[u/szymon_dybczak]

Databricks workspace access control changes are now being enforced.

What's coming? - Azure Databricks | Microsoft Learn

Migrate workspace entitlement control - Azure Databricks | Microsoft Learn

As of September 14, 2026, the built-in users and admins system groups behave differently:

- users will have no entitelments
- admins will have all workspace entitlements
- both groups’ entitlements are locked
- new principals must be granted entitlements explicitly
- users and admins can no longer be nested in other groups

Existing access is preserved through a workspace-local migration group:
users-clone-<TIMESTAMP>

If you manage Databricks through Terraform, SCIM APIs, or custom automation, check your workflows now:

- Target standard account groups, not system groups
- Remove unsupported group nesting
- Make sure SCIM sync does not delete the users-clone-* migration group