|
| 1 | +--- |
| 2 | +title: Azure AD on-premises app provisioning to Azure Databricks with Private Link Workspace |
| 3 | +description: This article describes how to use the Azure AD provisioning service to provision users into Azure Databricks with Private Link Workspace. |
| 4 | +author: billmath |
| 5 | +manager: amycolannino |
| 6 | +ms.service: active-directory |
| 7 | +ms.subservice: app-provisioning |
| 8 | +ms.topic: tutorial |
| 9 | +ms.workload: identity |
| 10 | +ms.date: 08/10/2023 |
| 11 | +ms.author: billmath |
| 12 | +ms.reviewer: owinoakelo |
| 13 | +--- |
| 14 | + |
| 15 | +# Microsoft Entra ID Application Provisioning to Azure Databricks with Private Link Workspace |
| 16 | + |
| 17 | +The Azure Active Directory (Azure AD) provisioning service supports a [SCIM 2.0](https://techcommunity.microsoft.com/t5/identity-standards-blog/provisioning-with-scim-getting-started/ba-p/880010) client that can be used to automatically provision users into cloud or on-premises applications. This article outlines how you can use the Azure AD provisioning service to provision users into Azure Databricks workspaces with no public access. |
| 18 | + |
| 19 | +[ ](media/azure-databricks-with-private-link-workspace-provisioning-tutorial/scim-architecture.png#lightbox) |
| 20 | + |
| 21 | +## Prerequisites |
| 22 | +* An Azure AD tenant with Microsoft Entra ID Governance and Azure AD Premium P1 or Premium P2 (or EMS E3 or E5). To find the right license for your requirements, see [Compare generally available features of Azure AD](https://www.microsoft.com/security/business/microsoft-entra-pricing). |
| 23 | +* Administrator role for installing the agent. This task is a one-time effort and should be an Azure account that's either a hybrid administrator or a global administrator. |
| 24 | +* Administrator role for configuring the application in the cloud (application administrator, cloud application administrator, global administrator, or a custom role with permissions). |
| 25 | +* A computer with at least 3 GB of RAM, to host a provisioning agent. The computer should have Windows Server 2016 or a later version of Windows Server, with connectivity to the target application, and with outbound connectivity to login.microsoftonline.com, other Microsoft Online Services and Azure domains. An example is a Windows Server 2016 virtual machine hosted in Azure IaaS or behind a proxy. |
| 26 | + |
| 27 | +## Download, install, and configure the Azure AD Connect Provisioning Agent Package |
| 28 | + |
| 29 | +If you have already downloaded the provisioning agent and configured it for another on-premises application, then continue reading in the next section. |
| 30 | + |
| 31 | + 1. In the Azure portal, select **Azure Active Directory**. |
| 32 | + 1. On the left, select **Azure AD Connect**. |
| 33 | + 1. On the left, select **Cloud sync**. |
| 34 | + [](media/azure-databricks-with-private-link-workspace-provisioning-tutorial/azure-active-directory-connect-new-ux.png#lightbox) |
| 35 | + |
| 36 | + 1. On the left, select **Agent**. |
| 37 | + 1. Select **Download on-premises agent**, and select **Accept terms & download**. |
| 38 | + >[!NOTE] |
| 39 | + >Please use different provisioning agents for on-premises application provisioning and Azure AD Connect Cloud Sync / HR-driven provisioning. All three scenarios should not be managed on the same agent. |
| 40 | + 1. Open the provisioning agent installer, agree to the terms of service, and select **next**. |
| 41 | + 1. When the provisioning agent wizard opens, continue to the **Select Extension** tab and select **On-premises application provisioning** when prompted for the extension you want to enable. |
| 42 | + 1. The provisioning agent uses the operating system's web browser to display a popup window for you to authenticate to Azure AD, and potentially also your organization's identity provider. If you're using Internet Explorer as the browser on Windows Server, then you may need to add Microsoft web sites to your browser's trusted site list to allow JavaScript to run correctly. |
| 43 | + 1. Provide credentials for an Azure AD administrator when you're prompted to authorize. The user is required to have the Hybrid Identity Administrator or Global Administrator role. |
| 44 | + 1. Select **Confirm** to confirm the setting. Once installation is successful, you can select **Exit**, and also close the Provisioning Agent Package installer. |
| 45 | + |
| 46 | +## Provisioning to SCIM-enabled Workspace |
| 47 | +Once the agent is installed, no further configuration is necessary on-premises, and all provisioning configurations are then managed from the Azure portal. |
| 48 | + |
| 49 | + 1. In the Azure portal, navigate to the Enterprise applications and add the **On-premises SCIM app** from the [gallery](../manage-apps/add-application-portal.md). |
| 50 | + 1. From the left hand menu, navigate to the **Provisioning** option and select **Get started**. |
| 51 | + 1. Select **Automatic** from the dropdown list and expand the **On-Premises Connectivity** option. |
| 52 | + 1. Select the agent that you installed from the dropdown list and select **Assign Agent(s)**. |
| 53 | + 1. Now either wait 10 minutes or restart the **Microsoft Azure AD Connect Provisioning Agent** before proceeding to the next step & testing the connection. |
| 54 | + 1. In the **Tenant URL** field, provide the SCIM endpoint URL for your application. The URL is typically unique to each target application and must be resolvable by DNS. An example for a scenario where the agent is installed on the same host as the application is `https://localhost:8585/scim` |
| 55 | +  |
| 56 | + |
| 57 | + 1. Create an Admin Token in Azure Databricks User Settings Console and enter the same in the **Secret Token** field |
| 58 | + 1. Select **Test Connection**, and save the credentials. The application SCIM endpoint must be actively listening for inbound provisioning requests, otherwise the test fails. Use the steps [here](../app-provisioning/on-premises-ecma-troubleshoot.md#troubleshoot-test-connection-issues) if you run into connectivity issues. |
| 59 | + >[!NOTE] |
| 60 | + > If the test connection fails, you will see the request made. Please note that while the URL in the test connection error message is truncated, the actual request sent to the application contains the entire URL provided above. |
| 61 | +
|
| 62 | + 1. Configure any [attribute mappings](../app-provisioning/customize-application-attributes.md) or [scoping](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md) rules required for your application. |
| 63 | + 1. Add users to scope by [assigning users and groups](../manage-apps/add-application-portal-assign-users.md) to the application. |
| 64 | + 1. Test provisioning a few users [on demand](../app-provisioning/provision-on-demand.md). |
| 65 | + 1. Add more users into scope by assigning them to your application. |
| 66 | + 1. Go to the **Provisioning** pane, and select **Start provisioning**. |
| 67 | + 1. Monitor using the [provisioning logs](../reports-monitoring/concept-provisioning-logs.md). |
| 68 | + |
| 69 | +The following video provides an overview of on-premises provisioning. |
| 70 | +> [!VIDEO https://www.youtube.com/embed/QdfdpaFolys] |
| 71 | +
|
| 72 | +## More requirements |
| 73 | +* Ensure your [SCIM](https://techcommunity.microsoft.com/t5/identity-standards-blog/provisioning-with-scim-getting-started/ba-p/880010) implementation meets the [Azure AD SCIM requirements](../app-provisioning/use-scim-to-provision-users-and-groups.md). |
| 74 | + Azure AD offers open-source [reference code](https://github.com/AzureAD/SCIMReferenceCode/wiki) that developers can use to bootstrap their SCIM implementation. |
| 75 | +* Support the /schemas endpoint to reduce configuration required in the Azure portal. |
| 76 | + |
| 77 | +## Next steps |
| 78 | + |
| 79 | +* [App provisioning](../app-provisioning/user-provisioning.md) |
| 80 | +* [Generic SQL connector](../app-provisioning/on-premises-sql-connector-configure.md) |
| 81 | +* [Tutorial: ECMA Connector Host generic SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) |
| 82 | +* [Known issues](../app-provisioning/known-issues.md) |
0 commit comments