Unable to enable datatbricks admin role to have access to the system.serving catalog

Hari 0 Reputation points
2026-08-20T06:57:53.2133333+00:00

This looks like a strange situation that i am facing here

i have created a databricks with existing user in my personal account

the user already have global administrator privilege

however after i signed into datbricks, this user(personal id) appeared as worksapce admin rather a account admin.

i realized this issue while attempting to access 'system.serving' catalog/table, where databricks not allowing user to access/grant permission to the system catalog.

As per the Microsoft documentation, when we create a databricks workspace / login to workspace, it initially provide Account admin privilege, but it user only granted workspace admin privilage.

As a workaround, i tried accessing below url- but it still blocking with error
'Logged in console with same user accounts.azuredatabricks.net

i am getting below error Selected user account does not exist in tenant 'Microsoft Services' and cannot access the application '2fsssss' in that tenant. The account needs to be added as an external user in the tenant first.'

i don't see any relevant information for resolving this issue.

Is there any solution to fix this?

Azure Databricks
Azure Databricks

An Apache Spark-based analytics platform optimized for Azure.

4 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-20T06:58:23.09+00:00

    Creating a Databricks workspace does not automatically make the creator an Azure Databricks account admin. It can make the user a workspace admin, but account-level administration is separate.

    For the first Azure Databricks account admin, a Microsoft Entra ID Global Administrator must sign in to the Azure Databricks account console. On first successful sign-in, that Global Administrator is automatically granted the account admin role. After that, the account admin can assign the role to other users.

    In this case, the main issue is the identity being used:

    1. Use a work or school account in Microsoft Entra ID, not a personal Microsoft account.
      • The error about the user not existing in tenant "Microsoft Services" indicates a tenant/account mismatch.
      • The context also shows that personal Microsoft accounts can fail for account console access and that Azure Databricks account access is tied to the correct Microsoft Entra tenant.
    2. Have a Microsoft Entra ID Global Administrator in the same tenant as the Databricks workspace sign in to the account console at https://accounts.azuredatabricks.net.
      • If no one in that tenant has logged in before, that first Global Administrator becomes the first Azure Databricks account admin.
    3. After that sign-in succeeds, assign the required role:
      • In the account console, go to User management.
      • Select the target user.
      • Open the Roles tab.
      • Turn on Account admin.
    4. If the Global Administrator is in multiple Microsoft Entra ID tenants, access the account console from within a workspace in the correct tenant instead of going directly to the account console URL. The direct URL opens the account console for the default tenant.
    5. Once an account admin exists, that account admin can manage account settings and Unity Catalog-related administration, including capabilities such as creating metastores, linking metastores to workspaces, assigning workspace admins, and managing metastore-level permissions.

    Important correction: the documentation does not say that creating a workspace or logging into a workspace automatically grants account admin. The automatic bootstrap applies to the first Global Administrator who signs in to the account console, not to any workspace creator.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. kagiyama yutaka 5,330 Reputation points
    2026-08-20T07:35:00.6533333+00:00

    I think Azure Databricks account‑level roles are restricted to Microsoft Entra work or school accounts in the same tenant as the Databricks account, and a personal Microsoft account (MSA) cannot sign in to the Databricks Account Console, so it can never receive the account admin role and therefore cannot access Unity Catalog system objects like system.serving.

    Was this answer helpful?

  3. SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator
    2026-08-21T15:07:54.2433333+00:00

    Hi @Hari

    Thank you for reaching out to the Microsoft Q&A forum

    The error occurs because a personal Microsoft account cannot be used to establish the first Azure Databricks Account Admin. The first Account Admin must be a Microsoft Entra ID Global Administrator from the same tenant associated with the Azure Databricks account.

    Please have a Microsoft Entra ID Global Administrator from the correct tenant sign in to the Azure Databricks Account Console. On the first successful sign-in, Azure Databricks automatically establishes that user as the Account Admin. The Account Admin can then go to user management, select the required organizational user, and assign the account Admin role.

    Recreating the Databricks workspace will not resolve this account-level access issue. Please use a work/school Microsoft Entra ID account from the same tenant for the initial Account Console sign-in.

    Was this answer helpful?

    0 comments
  4. Vinodh247-1375 44,556 Reputation points Volunteer Moderator
    2026-08-21T16:16:02.74+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    The behavior you're seeing is expected because Entra Global Administrator and Databricks Account Administrator are different roles.

    A user can be a Global Administrator in Microsoft Entra ID and still only be a Workspace Admin in Azure Databricks. Azure Databricks has separate administration scopes:

    • Account Admin: Manages the Databricks account, Unity Catalog enablement, identity administration, and account-level settings.
    • Workspace Admin: Manages users, groups, and settings within a specific workspace

    When a user with appropriate Azure permissions (such as Subscription Owner or Contributor) launches a Databricks workspace, Databricks can automatically grant the Workspace Admin role. However, this does not automatically make that user an Account Admin.

    The error you're receiving when accessing https://accounts.azuredatabricks.net:

    Selected user account does not exist in tenant 'Microsoft Services'...

    suggests an identity or tenant sign-in issue with the databricks Account Console, rather than a direct permission issue on the system.serving catalog.

    1. Verify that you're signing in with the same AAD that owns the databricks workspace.
    2. In Microsoft Entra ID, check whether the account is a Guest (B2B) user and review its User Principal Name (UPN).
    3. Try accessing the Databricks Account Console using an InPrivate/Incognito browser session to avoid cached credentials.
    4. Confirm whether an existing Databricks Account Admin can see your user in the account and explicitly assign the Account Admin role if needed. Account Admins are the only users who can delegate the Account Admin role.

    Also, regarding access to system.serving, becoming an Account Admin may not by itself resolve the issue. Unity Catalog access is governed by catalog ownership, metastore administration, and granted privileges. Depending on the object being accessed, you may also need the appropriate Unity Catalog permissions or Metastore Admin privileges.

    In summary, the immediate issue appears to be that the user is Workspace Admin only and is unable to access the Databricks Account Console due to an identity/tenant mismatch. I would resolve the Account Console sign-in issue first, then verify whether the required UC permissions exist for system.serving.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.