ApplianceManagedResourceGroupManagedByMismatch - Metadata corruption on Production Managed Resource Group

Question

Problem Description: We are encountering a deployment failure in our production pipeline when updating an existing Azure Databricks workspace.

Error Code: ApplianceManagedResourceGroupManagedByMismatch

Error Message: The managed resource group maep1-adp-dbrmgmt-rg already exists but is missing the required managedBy link to the workspace, or there is a casing mismatch.

Current State: * The Portal shows the Managed Resource Group is correctly linked to the workspace.

However, the Azure CLI (az group show --name maep1-adp-dbrmgmt-rg --query managedBy) returns null/empty.

  Manual attempts to fix the `managedBy` property via `az resource update` fail due to a __System Deny Assignment__ (ID: `7b4e76ed5e6d4f24bb8aab86950fbdc8`) created by the Databricks appliance.
  
  __Request:__ We need the Databricks Resource Provider to re-sync the "Appliance" state. Please either:
  

Answer 1

Hey Upasna,

It seems like you're experiencing a deployment failure with your Azure Databricks workspace due to the ApplianceManagedResourceGroupManagedByMismatch error. This issue indicates that while the managed resource group maep1-adp-dbrmgmt-rg exists, it lacks the necessary managedBy link to the workspace, possibly due to a casing mismatch or other metadata corruption.

Here are some steps you can take to troubleshoot and resolve the issue:

1. Check the Resource Group Link in Portal: Even though the portal indicates that the Managed Resource Group is linked to the workspace, it’s worth reviewing any discrepancies in the naming or metadata.
2. Verify Casing: Azure is case-sensitive, so ensure that the casing of your workspace and resource group names are identical in both the portal and CLI.
3. Attempt to Manually Resync: Since you've mentioned that attempts to modify the managedBy property via az resource update are failing due to a System Deny Assignment, you may need to reach out to Azure support directly to request a re-sync of the "Appliance" state for your Databricks Resource Provider.
4. Diagnostics: Use diagnostic tools in the Azure portal to see if additional errors are being reported related to this deployment. This can give you more context around what might be going wrong.
5. Review Permissions: Check if there might be any permission restrictions affecting your ability to modify the resource group. Ensure your account has the proper role assignments to manage this resource.

If these steps don’t resolve the issue, you might want to consider escalating the problem with Azure support for further assistance, as it seems there may be a deeper issue at play with the Azure Databricks deployment.

Follow-Up Questions

• Can you confirm if any recent changes were made to the resource group or workspace that might have triggered this issue?
• Are there specific role assignments or permissions associated with your account that might affect the modification of the managedBy property?
• Does the error happen consistently, or is it intermittent?

I hope this helps you get your production pipeline back on track!

References

• Data corruption or accidental deletion recovery guidance
• Azure Status
• Troubleshooting common problems in Azure Data Share
• Azure CLI documentation
• Azure Resource Manager locks

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.

Answer 2

I think that… once the MRG loses the managedBy ref, the RP won’t validate the state anymore and u’ll need support to clear the system‑deny so the RP can re‑sync the appliance metadata.

that’s the only reliable path when it drifts like this I think.