Managing Databricks Access for Cross Tenant Users

Hi YashikaAgrawal 

Since your Databricks environment will stay in the Infy tenant, and the users are moving to the TATA tenant, here’s what I’d suggest based on similar setups:

1. Stick with the existing security group in Infy
No need to change the way Databricks access is currently controlled. Even after the move, users from the TATA tenant can be added as B2B guest users in Infy and then included in the same Azure AD group that manages access to Databricks. So your group structure doesn’t need to be rebuilt.

2. Avoid manual ticketing with Access Packages
If you want to skip the manual part (which I highly recommend), look into Access Packages in Azure AD Entitlement Management (Infy tenant). These let external users (your TATA users) request access via a portal, and you can:

  a. Add approval steps

  b. Set access expiry (e.g. 30/60/90 days)

  c. Run access reviews later if needed

It’s a clean, secure way to give access without relying on ticketing or scripts.

3. A quick note on dynamic groups
Dynamic groups might sound like a good option, but unfortunately, they don’t support guest users at the moment — so they won’t help here.

4. What if you don’t have Entra P2?
If licensing is a blocker, you can still automate group assignments using PowerShell or Graph API, but it does require some custom scripting. That works too — just a bit more effort.

So, in short:

• Keep the Infy security group as the main control point
• Use Access Packages for smooth, self-service onboarding of TATA users
• Avoid dynamic groups for this case
• If needed, use scripts for automation instead