Facing issue with connecting databricks

Question

Dear,
I am working on POC using azure databricks, currently I am facing challenges while creating metastore to add Catelogs, facing error "Azure Managed Identity Credential with Access Connector Id /subscriptions/<SUB_ID>/resourceGroups/rg-wt-sd/providers/Microsoft.Databricks/accessConnectors/sd-wt-con and Managed Identity ID: for Account Id: <ACCOUNT_ID>could not be found."

Appreciate your help

Answer 1

Hi @Umesh Azure , Hope you are doing well.

This error means Unity Catalog can't resolve the Access Connector in your Databricks account context — even when the connector exists in Azure with correct RBAC. Here's the order to check, most likely first.

1. Are you a Databricks account admin? (most common cause on a POC)

Metastore creation happens in the account console at accounts.azuredatabricks.net, and requires the Databricks account admin role. Being an Azure subscription Owner or Contributor does not grant this — they're separate permission systems.

From your workspace, click your username → Manage Account. If it doesn't open or Catalog is unavailable, you're not an account admin yet. The first Azure AD Global Administrator to sign in to the account console can claim the role.

2. Your RBAC on the connector resource

Two distinct permissions are involved, and they're easy to conflate:

• The connector's identity needs Storage Blob Data Contributor on the ADLS Gen2 account — you likely have this.
• You need Contributor (or Microsoft.Databricks/accessConnectors/read) on the connector resource itself.

Open sd-wt-con → Access control (IAM) → Role assignments and confirm your account is listed. If the connector was created by IaC or a colleague, this is often the gap — and it surfaces as "could not be found" rather than a permission error.

3. Check the Managed Identity ID field

Your error shows Managed Identity ID: empty, which is correct for a system-assigned connector — that field is only for user-assigned identities. If your connector is system-assigned, leave it blank. If you've entered a value there, remove it and retry.

4. Existing metastore in the region

Only one metastore is allowed per region per Databricks account. In the account console under Catalog, check whether one already exists in your region — if so, assign your workspace to it instead of creating a new one.

5. If all of the above check out — use the CLI

The Databricks UI sometimes fails to resolve a correctly configured Access Connector, while the CLI/API path succeeds because it bypasses UI-level validation. This has resolved the identical error for other users:

databricks storage-credentials create --json '{
  "name": "<credential-name>",
  "azure_managed_identity": {
    "access_connector_id": "/subscriptions/<sub-id>/resourceGroups/rg-wt-sd/providers/Microsoft.Databricks/accessConnectors/sd-wt-con"
  }
}'

For a system-assigned connector, access_connector_id alone is sufficient. If this succeeds, the problem was UI-side, not permissions or identity.

To help narrow it down, could you confirm:

1. Can you open Manage Account and reach the Catalog page in the account console?
2. Is the connector system-assigned or user-assigned?
3. Are the connector, workspace, and storage account in the same region and subscription?

References

• Create a Unity Catalog metastore
• Use Azure managed identities in Unity Catalog to access storage
• Databricks CLI

Start with the account admin check — that's by far the most common cause when this appears during a first POC.

Kind Regards,
Microsoft Support Team.

Answer 2

That error points to the Azure Databricks access connector or managed identity not being available or not being recognized during metastore or credential setup.

Use this checklist:

1. Verify the access connector resource ID format. It must be in this format:

      /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Databricks/accessConnectors/<connector-name>
   

   If the ID is incorrect, Databricks cannot find the managed identity behind it.
2. Confirm the access connector actually exists in Azure. The metastore and service credential setup both require an Azure Databricks access connector with a managed identity.
3. Check permissions on the access connector. Registering a storage credential requires the Contributor role over the corresponding access connector. If this permission is missing, credential creation can fail.
4. If using a managed identity for credential creation, make sure the managed identity has the required role assignment on the target service and that the access connector resource ID is the one entered in Databricks.
5. If creating the metastore, enter the Access Connector ID exactly when creating the metastore in the account console:
   • Sign in as an account admin
   • Open Manage Account from the workspace
   • Go to Catalog
   • Select Create metastore
   • Enter the Access Connector ID in the required resource ID format
6. If access to the account console is the blocker, only a Databricks account admin can create the metastore. Being an Azure admin does not automatically grant Databricks account admin access.
7. If the scenario involves OneLake or external location setup, also verify that the managed identity or service principal has been added in the Fabric workspace with Administrator, Member, or Contributor role.

Relevant Databricks error conditions also indicate:

• Registering a credential requires the managed identity to have a Reader role scoped to the managed identity itself for the access connector.
• Only the account admin can create or update certain Unity Catalog storage credentials.

---

References:

• Create a Unity Catalog metastore
• Create service credentials
• Error conditions in Azure Databricks
• How to enable metastore in azure databricks. - Microsoft Q&A
• Unable to access Databricks Admin Console - Microsoft Q&A