An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
Hi ,
Thanks for reaching out to Microsoft Q&A.
This error is almost always not about the ID being “wrong”, but about Databricks not being able to resolve the managed identity behind the Access Connector at runtime. In your case, the likely causes are: the Access Connector’s system-assigned identity not fully provisioned/propagated, mismatch between the Databricks account region and the Access Connector region, or the identity not being discoverable due to RBAC or tenant boundary issues. Also, if you created and retried quickly, Azure sometimes takes a few minutes to make the managed identity visible to downstream services like Databricks.
What typically fixes it: wait ~5– to 10 mins after creating the access connector, then retry; explicitly verify that the Access Connector shows a principal ID in Azure Portal (if not, identity is not ready); reassign storage Blob Data Contributor at the container level (not just account) to that principal; and ensure the metastore region exactly matches the access connector + storage region. If this still fails, recreate only the Access Connector (not everything) and rebind roles that often clears stale identity references.
A few things I need to narrow this down further: Are you creating the metastore from the Databricks account console or workspace UI? Is your databricks account in the same tenant as the Azure subscription? Can you confirm the Access Connector shows a valid principalId/objectId in EntraID? And are you using systemassigned only or also passing a user-assigned identity ID (that field looks filled in your screenshot)?
Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.