Unity Catalog External Location fails with "PERMISSION_DENIED: Request for user delegation key is not authorized" when using Azure Access Connector with ADLS Gen2 over Private Endpoints

Hi Chetan,

Since the error is specifically:

Request for user delegation key is not authorized

I would focus on the user delegation key permission path, not only cluster-to-storage private endpoint connectivity.

A few things to check:

1. Make sure Storage Blob Delegator is assigned to the Access Connector managed identity at the storage account, resource group, or subscription scope. Container-level scope is not enough for Get User Delegation Key.

Confirm the role is assigned to the Access Connector’s managed identity principal ID, not just to the Access Connector resource.

Keep Storage Blob Data Contributor on the storage account/container for data access.

If public network access is disabled on the storage account, enable Allow Azure services on the trusted services list to access this storage account. Databricks documentation calls this out for Unity Catalog external locations when public network access is disabled.

Azure CLI example:

az storage account update \
  --name <storage-account-name> \
  --resource-group <resource-group-name> \
  --bypass AzureServices

Wait for Azure RBAC propagation, then re-validate the storage credential / external location.

Also check ADLS Gen2 ACLs on the target path if you are using ACLs in addition to RBAC.

Docs:

Unity Catalog external locations on ADLS Gen2: https://learn.microsoft.com/en-us/azure/databricks/connect/unity-catalog/cloud-storage/external-locations-adls

Azure managed identities for Unity Catalog storage: https://learn.microsoft.com/en-us/azure/databricks/connect/unity-catalog/cloud-storage/azure-managed-identities

Get User Delegation Key authorization: https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key

In short, private endpoint connectivity from the cluster proves the data plane path is reachable, but Unity Catalog also needs to generate temporary credentials. For that, the Access Connector managed identity must be allowed to request a user delegation key, and the storage firewall must allow the required Databricks/Azure service path.

Hi @chetan vekhande ,

Based on the information provided, the most likely cause is that the storage account has Public Network Access disabled without the required**"Allow Azure trusted services"** exception enabled.

Although your Databricks cluster can successfully reach the ADLS Gen2 account through Private Endpoints, Unity Catalog generates temporary credentials through a control-plane operation (generateTemporaryPathCredentials / User Delegation Key request). This request is not sourced from your VNet-injected cluster and must be allowed through the Azure trusted services path.

Since the Access Connector already has the required roles (Storage Blob Data Contributor, Storage Blob Delegator, and Reader), the RBAC configuration appears correct. The next step is to verify that the storage account networking configuration allows Azure trusted services access.

Also confirm that:

• The Unity Catalog Storage Credential references the correct Azure Databricks Access Connector.
• The role assignments are applied to the exact managed identity used by the Access Connector.
• RBAC changes have fully propagated.

If the issue persists after enabling Azure trusted services and validating the managed identity configuration, further investigation may be required to review storage account networking policies and Unity Catalog credential generation requests.

Reference Documentation

• Connect to an Azure Data Lake Storage Gen2 external location
• Use Azure managed identities in Unity Catalog
• Access control lists (ACLs) in Azure Data Lake Storage - Azure Storage | Microsoft Learn [Access con...soft Learn | Learn.Microsoft.com]

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.