databricks-enterprise-rbac

# Databricks Enterprise RBAC ## Overview Implement enterprise access control using Unity Catalog privileges, SCIM-provisioned groups, workspace entitlements, cluster policies, and audit logging. Unity Catalog uses a three-level namespace (`catalog.schema.object`) with privilege inheritance: granting `USAGE` on a catalog cascades to schemas. Account-level SCIM syncs groups from your IdP (Okta, Azure AD, Google Workspace). ## Prerequisites - Databricks Premium or Enterprise with Unity Catalog enabled - Account admin access for SCIM and group management - Identity Provider supporting SAML 2.0 and SCIM 2.0 ## Instructions ### Step 1: Provision Groups via SCIM API Sync groups from your IdP at the account level. Max 10,000 users + service principals and 5,000 groups per account. ```bash # Create account-level groups that map to IdP teams databricks account groups create --json '{ "displayName": "data-engineers", "entitlements": [ {"value": "workspace-access"}, {"value": "databricks-sql-access"} ] }' databricks account groups create --json '{ "displayName": "data-analysts", "entitlements": [ {"value": "workspace-access"}, {"value": "databricks-sql-access"} ] }' databricks account groups create --json '{ "displayName": "ml-engineers", "entitlements": [ {"value": "workspace-access"}, {"value": "databricks-sql-access"}, {"value": "allow-cluster-create"} ] }' ``` ```python # Assign groups to workspaces from databricks.sdk import Acco...