Skip to main content

Activate SSO

You'll configure SSO so users sign in to Databricks with your identity provider in ~10 min.

Prereqs: Add Users, Add Groups, identity provider admin access

The big picture​

Single sign-on at the Databricks account level. Users sign in through your existing identity provider, so there are no separate Databricks passwords to manage or revoke.

Prerequisites​

  • Account-admin access to the Databricks account console.
  • Admin access to your identity provider (Entra ID, Okta, or another SAML/OIDC provider).

Steps​

Walkthrough · 2 steps · ~10 min

Choose your cloud path, configure the identity provider when required, then test the redirect.

1

Choose the path for your cloud:

  • Azure: Nothing to configure. Entra ID SSO is on by default for Azure Databricks.
  • AWS: Open Configure SSO for AWS, configure the SAML or OIDC application in your identity provider, then register it under Settings > Single sign-on in the account console.
  • GCP: Google SSO is often on already. If it is not, open Configure SSO for GCP, configure the SAML or OIDC application in your identity provider, then register it in the account console.
2

Open a private or incognito browser window and go to the workspace URL. Confirm the login redirects to your identity provider, then sign in and confirm you land in the workspace.

Reference: Configure SSO (Databricks docs)

Verify​

  1. Log in to a workspace through SSO from a private browser window.
  2. In the account console, open Settings > Single sign-on and confirm the configuration shows as active.

Where people trip​

SSO redirect fails or loops

Check the SAML/OIDC reply URL configured in your IdP. It must match the URL registered in the Databricks account console exactly. Trailing slashes and protocol mismatches are common causes.

User authenticates but cannot access a workspace

SSO handles authentication, not authorization. The user must also be assigned to the workspace. Verify their assignment in the account console under the workspace's permission settings.

Azure: Entra ID SSO not working

Entra ID SSO is enabled by default, but the user must exist in the linked Entra ID directory. If using a guest account or B2B user, verify the account has been invited and accepted.

Next​