Error creating service credentials from Access Connector in Azure Databricks

Question

I set up an Access Connector for Azure Databricks and granted it Blob Contributor access on the target storage account. Since service credentials are required, I tried creating them using this Access Connector (managed identity). However, I keep getting the following error:

Missing validation token for service principal. Please provide a valid ARM-scoped Entra ID token in the 'X-Databricks-Azure-SP-Management-Token' request header and retry. For details, check https://docs.databricks.com/api/workspace/storagecredentials

I’ve been stuck on this issue for the past three days and haven’t been able to resolve it. Has anyone encountered this before or knows what I might be missing?

Happy to share more details if needed. Thanks in advance for your help!

Answer 1

Error: Missing validation token for service principal. Please provide a valid ARM-scoped Entra ID token in the 'X-Databricks-Azure-SP-Management-Token' request header and retry. For details, check https://docs.databricks.com/api/workspace/storagecredentials

Hi!

I hit this for a week and finally got it working. Sharing what fixed it for me.

• If your Azure user shows #EXT# in the User Principal Name (UPN), you’re on a guest account. Databricks doesn’t like that for external credentials.

What I did

1. Open the Azure portal → search Microsoft Entra ID.
2. Go to Users → open your account.
3. In Properties, check User principal name.
   • If it has #EXT#, that’s the problem.
4. Switch to the tenant that owns your resources (not the guest one), or use a non-guest user for that tenant.
5. Go back to Databricks and try creating the External Credential again under the correct directory/tenant.
6. If it still won’t cooperate sign in at https://accounts.azuredatabricks.net/login using the correct tenant, then retry the steps you did before getting this error.

Once you’ve done this, you should be able to move on with the next steps.

If this fix helped, comment so others can find it. Happy learning!

Answer 2

Hello Darshan Jain,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having error creating service credentials from Access Connector in Azure Databricks.

The error occurs because Databricks requires two tokens when creating service/storage credentials with an Access Connector: a Databricks API token (Authorization: Bearer) and an ARM-scoped Entra ID token (X-Databricks-Azure-SP-Management-Token) obtained for the scope https://management.azure.com/.default. If you’re using the UI, Databricks handles this automatically once the Access Connector’s managed identity has Storage Blob Data Contributor on the storage account; if automating API/Terraform, you must explicitly fetch the ARM token via a service principal OAuth flow or IMDS for managed identities, then include it with the Databricks call as shown in the Databricks storage credentials API docs.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Answer 3

Hello Darshan Jain,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I went through all the discussions that happened till now and I understand you want to allow Azure Databricks (via an Access Connector) to securely access a storage account, by creating a credential inside Unity Catalog, using the UI, currently you are stuck at creating the credentials.

I reproduced your problem and was able to create the credentials.

So, I am not going to talk about access, I think you already have that sorted. However, still mentioning the accesses that I used.

• My Storage Account has a managed identity role assignment for the Access Connector which has a role of Storage Blob Data Contributor access.
• Note: I am the owner of my subscription.

Choose the Unity Catalog Metastore.

• In the top-left dropdown, make sure you're in the Unity Catalog metastore (not Hive or legacy catalogs) and continue creating the credentials. Here's a snip of the credential that I created. Let us know if you need anything further.

Answer 4

This is the correct solution below, try to follow this
this is the next step of RJ Aragon ans above

When setting up Azure Databricks with Unity Catalog or configuring external storage, you may encounter errors like:

• Missing validation token
• Or your account appears as:

xyz_gmail.com#EXT#@<tenant>.onmicrosoft.com

This happens because your Microsoft account is treated as a guest user in the tenant created during Azure signup.

---

Why This Happens

• Signing up for Azure with a personal Microsoft account creates a tenant (e.g., xyz.onmicrosoft.com) and adds your account as a guest.
• Guest accounts cannot generate ARM tokens for Databricks external storage setup.
• You need a native user in the tenant with proper permissions.

---

Solution (Step-by-Step)

Step 1: Create a Native User

1. Go to Azure Portal → Microsoft Entra ID → Users → New User.
2. Fill details:
   • Username: ******@xyz.onmicrosoft.com
     • Assign Global Administrator role.
     1. Set a password and save.

---

Step 2: Sign in With the Native User

• Sign out from your Microsoft account.
• Sign in using:

******@xyz.onmicrosoft.com

• Switch directory to your tenant (Default Directory).

---

Step 3: Assign Owner Role to New User

1. Go to Subscriptions → [Your Subscription] → Access Control (IAM).
2. Click Add → Add role assignment.
3. Select Owner.
4. Assign to your new user.
5. Click Review + assign.

---

Step 4: Verify

• Log in as the new user.
• Go to Subscriptions → You should see all your existing resources (Databricks, VNet, Storage, etc.).

---

Step 5: Retry Databricks Setup

• Launch Databricks workspace from Azure Portal.
• Create Storage Credential for Unity Catalog using:
  • Managed Identity (recommended), or
    • Service Principal (if needed).

---

After this, the #EXT# issue is gone, and Databricks will accept ARM tokens.

---

---