Unable to create metastore from Account Console

The error shows an empty Managed Identity ID, so configure ac-datalakepasha with a system-assigned identity and leave Managed Identity ID blank when recreating the metastore; if the connector uses only a user-assigned identity, enter that identity’s full Azure resource ID instead.

1. Validate the Access Connector identity

In the Azure portal:

1. Open Access Connector for Azure Databricks → ac-datalakepasha.
2. Open Settings → Identity.
3. Determine which configuration applies:
   • System-assigned identity: Set Status to On, select Save, and leave the metastore’s Managed Identity ID field empty.
   • User-assigned identity: Confirm the intended identity appears under User assigned, then copy its complete Azure Resource ID. Enter that value in Managed Identity ID during metastore creation.
4. From the connector’s Overview or Properties page, copy its Resource ID rather than typing it manually. It must have this structure:

/subscriptions/[Subscription ID] ID]/resourceGroups/[Resource Group] Group]
/providers/Microsoft.Databricks/accessConnectors/<connector-name>

An Access Connector can contain a system-assigned identity, user-assigned identities, or both. The Managed Identity ID field is optional and is used when selecting a user-assigned identity.^1^

Also confirm the connector is in the same Microsoft Entra tenant as the Azure Databricks account. The connector may be in any subscription, but it must be in that tenant.^1^

2. Grant storage access to that exact identity

The user assigning this role must be Owner or User Access Administrator on the storage account.

1. Open the ADLS Gen2 storage account.
2. Select Access Control (IAM) → Add → Add role assignment.
3. Select Storage Blob Data Contributor.
4. For Assign access to, select Managed identity.
5. Select the same identity configured above:
   • Access connector for Azure Databricks for its system-assigned identity, or
   • User-assigned managed identity for the attached user-assigned identity.
6. Select Review + assign.^1^

Do not grant the role to a similarly named connector or to the workspace’s managed identity; the role must target the identity represented by the Access Connector entered in the metastore form.

3. Recreate the metastore with matching values

Sign in as an Azure Databricks account admin, then open:

Workspace → user menu → Manage Account → Catalog → Create metastore

Enter:

• Region: The workspace region. The metastore, attached workspaces, and metastore storage must use the same region.
• ADLS Gen2 path: The intended container/path.
• Access Connector ID: The copied resource ID.
• Managed Identity ID:
  • Leave blank for the connector’s system-assigned identity.
  • Enter the full user-assigned managed identity resource ID only when using that identity.

Select Create, then attach the workspace when prompted.^2^

The workspace must be on the Premium plan, and metastore creation requires the Azure Databricks account admin role; Azure subscription Owner or Microsoft Entra Global Administrator alone does not automatically provide ongoing Databricks account-admin access.^2^

If the connector was deleted or recreated

Azure Databricks documents this error class as a managed-identity credential lookup failure. A deleted or recreated connector can also invalidate an existing credential reference.^3^

Create a new Access Connector, enable the required identity, reassign its storage RBAC role, and use its new resource ID when creating the metastore. Do not reuse the old connector ID.

If all values are correct but the same error persists, open a Microsoft support request and include:

• Azure Databricks account ID
• Workspace and metastore regions
• Access Connector resource ID
• Identity type: system-assigned or user-assigned
• User-assigned identity resource ID, if applicable
• The full error and request/correlation ID

References

1. Use Azure managed identities in Unity Catalog to access storage
2. Create a Unity Catalog metastore
3. Error conditions in Azure Databricks