Setup UC Metastore in Gov Cloud.

Question

I am trying to setup/configure Unity Catalog in our Azure Databricks Service in gov cloud. There's no UI support to do this in gov cloud so I am attempting to do it via the CLI.

To use the CLI, I will first need to authenticate via a service principal. I already created an app registration in gov cloud with respective client/secret keys.  The next step is to assign this service principal as an account admin to our dbx account. But in gov cloud, there's no UI for the admin account console (as there is in commercial cloud). 

Any guidance on how this can be done? 

 

Answer 1

Hello Ryan De Four,

Thank you again for your posting your query on Microsoft QnA! . I also thank our community member Vinodh247 for the spot on response. I would like to add the following important context and details:

While it’s true that Azure Databricks on Azure Government (Gov) Cloud does not have the Account Console UI found in the commercial cloud, and that account admin assignments are initiated from the commercial Account Console by an Entra ID Global Admin, there are a few extra points to keep in mind:

1. In Gov regions, admin assignments at the account level require initial setup by an Entra (Azure AD) Global Admin outside Gov. This admin can then delegate account admin roles to other users (including service principals). Reference: https://learn.microsoft.com/en-us/azure/databricks/admin/#establish-your-first-account-admin
2. Once an account admin is assigned, they can delegate workspace admin rights within your Databricks workspaces. Workspace admins manage daily permissions and workspace-level access, but do not have access to account-wide configuration unless given the higher privilege. Reference: https://learn.microsoft.com/en-us/azure/databricks/admin/
3. Feature Limitations Specific to Gov Cloud: Not all Unity Catalog or account-level features available in commercial cloud are supported in Gov. The lack of the Account Console UI and some APIs can change how admin assignments and configuration are handled. Microsoft maintains an up-to-date list of support and limitations for Azure Government: Unity Catalog feature limitations and region support
4. If there are roadblocks or you cannot find a currently assigned account admin, Microsoft and Databricks support teams are prepared to help, given the governance limitations. You may need to file a support request for admin changes in Gov regions. Unity Catalog volumes – not available in Azure Government regions

Please also consider:

Confirming with your internal Azure administrators if any existing account admin (user or service principal) can make the required changes via API or CLI.

• Keeping security/compliance stakeholders aware that account-level admin assignments may take additional time in Gov Cloud and may need to involve central cloud identity teams or official support tickets.

If you encounter any errors or further restrictions when using the CLI after admin rights are established, please share any specific error message or operation that did not succeed. We can help troubleshoot API or permission details if you provide that context.

References:

https://learn.microsoft.com/en-us/azure/databricks/admin/#establish-your-first-account-admin

https://learn.microsoft.com/en-us/azure/databricks/admin/

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer 2

Hi ,

Thanks for reaching out to Microsoft Q&A.

Azure Databricks in Azure Gov Cloud doesn’t offer the Account Console UI, which blocks the usual route for assigning a service principal as an Account Admin

1. Databricks in Gov Cloud has no Account Console UI: you can’t assign the SP to an admin role using the UI.
2. You need an Entra ID Global Admin (likely outside Gov Cloud) to assign Account Admin to your SP via the commercial Account Console.
3. Once SP is an Account Admin, you can fully use APIs/CLI to:
   • Create the Unity Catalog metastore
   • Attach storage credentials
   • Manage access and link workspaces

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.