Identity Attribute Control List

The Identity Attribute Control List is an account-level allowlist that governs which identity attributes can be written to users in your Databricks account. Account admins enable it as a feature preview to control attribute writes across SCIM and automatic identity management.

Beta

This feature is in Beta. Account admins can manage access to this feature from the account console Previews page. See Manage account-level previews.

The attribute control list is enabled through the account-level Identity Attribute Control List feature preview, which is off by default. An account admin enables it from the account console Previews page. See Manage account-level previews.

Overview

The attribute control list is an account-level allowlist that decides which of the nine identity attributes may be written on users in your account, across all write sources. An account admin uses it to control which attributes can be written to Databricks.

The list is enforced on writes only:

• Reads are never filtered. An attribute stored earlier stays fully visible even after it is removed from the list.
• Removals of stored values are always permitted, so an administrator can always retire a value, including for an attribute the account no longer allows.

You don't need to enable the preview to write attributes through the SCIM API. Enabling it adds control over which attributes can be written, and, when automatic identity management is enabled, reconciles each user's stored attributes against the list on every sync.

Enable the preview

Enrollment is an account-level feature preview named Identity Attribute Control List, toggled from the Previews page in the account console. The toggle is off by default.

1. As an account admin, log in to the account console.
2. In the sidebar, click Previews.
3. Turn on the Identity Attribute Control List toggle.

Enabling and disabling the preview changes only what future writes are allowed to do. It never retroactively alters values already stored on your users. However, with automatic identity management enabled, the next sync reconciles users against the list, which can remove stored data. See How enforcement works.

Configure the control list

When your account is enrolled in the preview, you configure the list in the account console.

1. As an account admin, log in to the account console.
2. In the sidebar, click Security.
3. Click User provisioning.
4. In the Configure identity attributes section, click Manage attributes.
5. In the Manage identity attribute control list dialog, select the checkbox for each attribute you want to allow, and clear the checkbox for each attribute you want to disallow.
6. Click Save.

The dialog presents all nine attributes as checkboxes (Title, User type, Locality, Region, Country, Cost center, Organization, Division, and Department), with the currently allowed attributes selected. Save is disabled until you change a selection.

The Configure identity attributes section is only visible when your account is enrolled in the preview. If you don't see it, the preview isn't enabled for your account.

How enforcement works

The control list is enforced on writes only. How that enforcement behaves depends on whether attributes are written through automatic identity management or through SCIM.

With automatic identity management

Automatic identity management pulls attributes from your identity provider (IdP) on a schedule, and the control list governs that sync. The behavior differs sharply depending on whether the preview is enabled.

With the preview disabled, automatic identity management doesn't touch identity attributes. It doesn't sync them in, and it doesn't clear anything already stored. Attributes are outside the scope of the sync.

With the preview enabled, each sync reconciles the user against the control list:

• Only attributes that are both set in the IdP and on the control list are synced in.
• An attribute not on the list is cleared from the Databricks user, even if it holds a value set earlier through SCIM.
• An attribute that is on the list but absent or emptied in the IdP is cleared in Databricks, so the two stay in step.
• If the control list is empty, the sync clears all nine attributes.

A sync is not instantaneous. After you toggle the preview or edit the list, allow a few minutes before the change is reflected on a user. For sync timing, see Identity attributes.

If you accidentally remove an attribute from the control list and automatic identity management deletes the stored value from your users, you can recover by re-adding the attribute to the control list and letting automatic identity management sync the identity again.

With SCIM

The preview doesn't need to be enabled to manage attributes through the SCIM API, but it adds control over which attributes can be written when enabled.

With the preview enabled, an insert or update of an off-list attribute through account SCIM 2.1 is rejected with 400 Bad Request and a scimType of invalidValue, and the detail names the offending attributes. This rejection has the following properties:

• A rejected PATCH is atomic. If any operation targets an off-list attribute, the whole request is rejected and none of the allowed changes apply. Validation runs before the user record is touched.
• Only changed values are checked. Re-sending a value identical to the stored one is a no-op and passes even for an off-list attribute. A connector can keep syncing successfully after you narrow the list, and only start failing when the IdP-side value next changes.
• Removals are always allowed. You can always clear a stored value, including for an attribute that is no longer on the list.

When automatic identity management is not enabled, removing an attribute from the control list does not delete SCIM-synced values already stored on your users. Narrowing the list stops future writes but leaves stored values alone until someone removes them.

For the exact error body and how to recover a connector whose sync starts failing after you narrow the list, see Manage identity attributes with account SCIM.

Limitations

The attribute control list has the following limitations in Beta:

• The control list can only be configured in the account console. There is no API to configure it programmatically.
• The control list governs identity attributes on users only. Service principals and groups are not yet supported.