Unity Catalog metastore creation fails - Managed Identity could not be found

Hi @Zubaer Shaik , Hope you are doing well.
Your checklist is thorough, so let me point at the gaps it doesn't cover.

Your error string contains a clue

Managed Identity ID:  for Account Id: eb77f564-...

The Managed Identity ID is empty. That's actually correct for your setup — per the docs, that field is only populated "if you created the access connector using a user-assigned managed identity." You're on system-assigned, so leaving it blank is right. This tells us Databricks isn't rejecting a bad value; it can't resolve the connector's system-assigned identity at all. That points at permissions or tenant scope, not configuration.

Most likely cause: your RBAC on the Access Connector itself

Your list confirms Storage Blob Data Contributor on the storage account — but that's a different permission from the one needed here. The documentation requires:

"You must have the Contributor role or higher on the access connector resource in Azure."

Check the connector's Access control (IAM) → Role assignments and confirm your account (the one signed into the Databricks account console) holds Contributor or Owner on the connector resource, not just on the resource group or storage. If the connector was created by a colleague or by IaC under a service principal, this is very often the missing piece — and it produces exactly a "could not be found" message, because the resolution call returns nothing rather than a permission error.

First check: tenant alignment

The error references your Databricks Account Id. Confirm the tenantId returned by

az databricks access-connector show --name spiderconnector \
  --resource-group dbricksmeta --query identity

matches the Entra tenant your Databricks account (accounts.azuredatabricks.net) is homed in. A connector in a different tenant is invisible to the account even though the CLI shows it as healthy.

Second: confirm you're an account admin

Metastore creation happens in the account console, not the workspace, and requires the account admin role. Workspace admin isn't sufficient. Your checklist confirms workspace-level items but not this one.

On region

Co-locating the connector, workspace, metastore, and storage is a performance recommendation in the docs, not a validation requirement — so a mismatch is unlikely to be your blocker. Worth noting: only one metastore per region per account, so if one already exists in your target region, creation will conflict.

If all three check out

Recreate the Access Connector with a fresh system-assigned identity, re-grant Storage Blob Data Contributor on the storage account, note the new resource ID, and retry. This clears any stale identity metadata. If it still fails with the same message, raise a support case with the timestamp and the (redacted) error — resolution failures against a healthy connector need backend log access.

References

• Use Azure managed identities in Unity Catalog to access storage
• Create a Unity Catalog metastore
• Create service credentials — permissions on the access connector

Start with the Contributor role on the connector — that's the most common cause of this exact message given everything else you've already verified.

Kind Regards,
Microsoft Support Team.

Hi @Zubaer Shaik

please confirm are you assigned roles properly from access connector. then only its pass others wise failed in azure databricks.

Thanks.