title: Terraform Azure Databricks Provider Error
body: <p>I need some assistance to undertand the various forms of logging in to Databricks. I am using Terraform to provision Azure Databricks
  I would like to know the difference in the two codes below
  When i use option 1, i get the error as shown</p>
  <p>Option 1:</p>
  <pre><code>  required_providers {
      azuread     = &quot;~&gt; 1.0&quot;
      azurerm     = &quot;~&gt; 2.0&quot;
      azuredevops = { source = &quot;registry.terraform.io/microsoft/azuredevops&quot;, version = &quot;~&gt; 0.0&quot; }
      databricks  = { source = &quot;registry.terraform.io/databrickslabs/databricks&quot;, version = &quot;~&gt; 0.0&quot; }
    }
  }
  
  provider &quot;random&quot; {}
  provider &quot;azuread&quot; {
    tenant_id     = var.project.arm.tenant.id
    client_id     = var.project.arm.client.id
    client_secret = var.secret.arm.client.secret
  }
  
  provider &quot;databricks&quot; {
    host          = azurerm_databricks_workspace.db-workspace.workspace_url
    azure_use_msi = true
  }
  
  resource &quot;azurerm_databricks_workspace&quot; &quot;db-workspace&quot; {
    name                          = module.names-db-workspace.environment.databricks_workspace.name_unique
    resource_group_name           = module.resourcegroup.resource_group.name
    location                      = module.resourcegroup.resource_group.location
    sku                           = &quot;premium&quot;
    public_network_access_enabled = true
  
    custom_parameters {
      no_public_ip                                         = true
      virtual_network_id                                   = module.virtualnetwork[&quot;centralus&quot;].virtual_network.self.id
      public_subnet_name                                   = module.virtualnetwork[&quot;centralus&quot;].virtual_network.subnets[&quot;db-sub-1-public&quot;].name
      private_subnet_name                                  = module.virtualnetwork[&quot;centralus&quot;].virtual_network.subnets[&quot;db-sub-2-private&quot;].name
      public_subnet_network_security_group_association_id  = module.virtualnetwork[&quot;centralus&quot;].virtual_network.nsgs.associations.subnets[&quot;databricks-public-nsg-db-sub-1-public&quot;].id
      private_subnet_network_security_group_association_id = module.virtualnetwork[&quot;centralus&quot;].virtual_network.nsgs.associations.subnets[&quot;databricks-private-nsg-db-sub-2-private&quot;].id
    }
    tags = local.tags
  }
  </code></pre>
  <h1>Databricks Cluster Creation</h1>
  <pre><code>resource &quot;databricks_cluster&quot; &quot;dbcselfservice&quot; {
    cluster_name            = format(&quot;adb-cluster-%s-%s&quot;, var.project.name, var.project.environment.name)
    spark_version           = var.spark_version
    node_type_id            = var.node_type_id
    autotermination_minutes = 20
    autoscale {
      min_workers = 1
      max_workers = 7
    }
    azure_attributes {
      availability       = &quot;SPOT_AZURE&quot;
      first_on_demand    = 1
      spot_bid_max_price = 100
    }
    depends_on = [
      azurerm_databricks_workspace.db-workspace
    ]
  }
  </code></pre>
  <h1>Databricks Workspace RBAC Permission</h1>
  <pre><code>resource &quot;databricks_group&quot; &quot;db-group&quot; {
    display_name               = format(&quot;adb-users-%s&quot;, var.project.name)
    allow_cluster_create       = true
    allow_instance_pool_create = true
    depends_on = [
      resource.azurerm_databricks_workspace.db-workspace
    ]
  }
  
  resource &quot;databricks_user&quot; &quot;dbuser&quot; {
    count            = length(local.display_name)
    display_name     = local.display_name[count.index]
    user_name        = local.user_name[count.index]
    workspace_access = true
    depends_on = [
      resource.azurerm_databricks_workspace.db-workspace
    ]
  }
  </code></pre>
  <h1>Adding Members to Databricks Admin Group</h1>
  <pre><code>resource &quot;databricks_group_member&quot; &quot;i-am-admin&quot; {
    for_each  = toset(local.email_address)
    group_id  = data.databricks_group.admins.id
    member_id = databricks_user.dbuser[index(local.email_address, each.key)].id
    depends_on = [
      resource.azurerm_databricks_workspace.db-workspace
    ]
  }
  
  data &quot;databricks_group&quot; &quot;admins&quot; {
    display_name = &quot;admins&quot;
    depends_on = [
      #    resource.databricks_cluster.dbcselfservice,
      resource.azurerm_databricks_workspace.db-workspace
    ]
  }
  </code></pre>
  <p>The error that i get while TF apply is below :</p>
  <pre><code>Error: User not authorized
  
  with databricks_user.dbuser[1],
  on resources.adb.tf line 80, in resource &quot;databricks_user&quot; &quot;dbuser&quot;:
  80: resource &quot;databricks_user&quot; &quot;dbuser&quot;{
  
  
  Error: User not authorized
  
  with databricks_user.dbuser[0],
  on resources.adb.tf line 80, in resource &quot;databricks_user&quot; &quot;dbuser&quot;:
  80: resource &quot;databricks_user&quot; &quot;dbuser&quot;{
  
  Error: cannot refresh AAD token: adal:Refresh request failed. Status Code =  '500'. Response body: {&quot;error&quot;:&quot;server_error&quot;, &quot;error_description&quot;:&quot;Internal server error&quot;} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&amp;resource=https%3A%2F%2Fmanagement.core.windows.net%2F
  
  with databricks_group.db-group,
  on resources.adb.tf line 80, in resource &quot;databricks_group&quot; &quot;db-group&quot;:
  71: resource &quot;databricks_group&quot; &quot;db-group&quot;{
  </code></pre>
  <p>Is the error coming because of this block below ?</p>
  <pre><code>provider &quot;databricks&quot; {
    host          = azurerm_databricks_workspace.db-workspace.workspace_url
    azure_use_msi = true
  }
  </code></pre>
  <p>I just need to login automatically when i click on the URL from the portal. So what shall i use for that? And why do we need to provide two times databricks providers, once under required_providers and again in provider &quot;databricks&quot;?
  I have seen if i don't provide the second provider i get the error :</p>
  <pre><code>&quot;authentication is not configured for provider&quot;
  </code></pre>