Authenticate with Azure PowerShell

This page explains how to use Azure PowerShell to sign in to Azure Databricks with either a user account or a Microsoft Entra ID service principal.

Sign in as a user

To sign in with a user account, run the Connect-AzAccount -Environment AzureChinaCloud cmdlet and follow the on-screen instructions:

Connect-AzAccount -Environment AzureChinaCloud

Note

If PowerShell doesn't recognize Connect-AzAccount -Environment AzureChinaCloud, install it by running Install-Module -Name Az -Repository PSGallery -Force.

Verify your subscription by running:

Get-AzContext | Select-Object -ExpandProperty Subscription

To get the correct subscription ID:

  • Azure portal: Click your username > Azure Portal > Overview. Copy the Subscription ID.
  • Account console: Click your username > Manage Account > Workspaces, search for your workspace, and note the Subscription field.

Switch subscriptions if needed:

Set-AzContext -Name "<subscription-name>"
# Or
Set-AzContext -Subscription <subscription-id>

If you see The subscription of '<subscription-id>' doesn't exist in cloud 'AzureCloud', get your tenant ID by running curl -v <per-workspace-URL>/aad/auth. Look for the ID in the location response header. See Get subscription and tenant IDs. Then reconnect:

Connect-AzAccount -Environment AzureChinaCloud -Tenant <tenant-id> | Format-Table

Sign in as a Microsoft Entra ID service principal

Important

Databricks recommends using Azure Databricks managed service principals for most use cases. Only use Microsoft Entra ID managed service principals when you need to access Azure resources, as they require additional Microsoft Entra ID permissions.

To sign in with a Microsoft Entra ID service principal, gather the following from your Microsoft Entra ID application:

  • Tenant ID: Directory (tenant) ID
  • Client ID: Application (client) ID
  • Client secret: The secret value

Sign in by running the following commands one at a time:

$SecurePassword = ConvertTo-SecureString -String "<Client-secret>" -AsPlainText -Force
$TenantId = "<Tenant-ID>"
$ApplicationId = "<Client-ID>"
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $ApplicationId, $SecurePassword
Connect-AzAccount -Environment AzureChinaCloud -ServicePrincipal -TenantId $TenantId -Credential $Credential

Note

If PowerShell doesn't recognize Connect-AzAccount -Environment AzureChinaCloud, install it by running Install-Module -Name Az -Repository PSGallery -Force.

Verify your subscription and switch if needed by following the steps in Sign in as a user.