What are the benefits of AIM?

Summary

• AIM is Automatic Identity Management. It is an account-level, just-in-time identity provisioning system that provisions users automatically when they first sign in to Databricks.
• Less administrative overhead. Users are provisioned on the spot from your identity provider with no manual setup or pre-sync, and it propagates to all workspaces automatically.
• Automatic lifecycle management. Users removed from the identity provider are deactivated on the next sync, reducing identity drift and keeping Databricks in sync with your source of truth.
• Comprehensive coverage. AIM syncs users, groups (including nested groups), and service principals, so group-based Unity Catalog permissions reflect real organizational structure.
• Faster access for business users. People are provisioned when they open a shared dashboard or Genie Agent, removing a key friction point to platform access.

What are the benefits of AIM?

AIM stands for Automatic Identity Management. It is an account-level, just-in-time (JIT) identity provisioning system on Databricks: when a user tries to sign in, AIM looks them up in your identity provider (such as Microsoft Entra ID) and provisions them on the spot, with no manual setup or pre-sync required. It uses a pull-based model in which Databricks continuously synchronizes identities directly from the identity provider.

Why Automatic Identity Management on Databricks

• Simplified onboarding, less overhead. AIM requires significantly less administrative work than manual provisioning, and it propagates to all workspaces automatically. Users can open a Databricks URL and sign in via SSO with no extra work from an admin.
• Just-in-time provisioning. New users are provisioned automatically on first login — any user who successfully authenticates via SSO is created in Databricks on first sign-in, with no per-user admin action.
• Automatic lifecycle management. Users removed from the identity provider are automatically deactivated on the next sync cycle. This reduces identity drift and keeps Databricks identities aligned with your source of truth, which is also a security benefit.
• Comprehensive identity coverage. AIM syncs users, groups (including nested groups), and service principals from the identity provider, so group-based permissions in Unity Catalog and workspaces reflect real organizational structures.
• Scales for business-user adoption. As Databricks is consumed by more business users through AI-powered interfaces such as Genie, AIM removes a key friction point: people can share dashboards and Genie Agents with a user or group, and recipients are provisioned when they click the link instead of requiring pre-provisioning.

AIM grants access to the Databricks platform itself; it does not automatically grant permissions to datasets, dashboards, notebooks, or workspaces. Existing entitlement and sharing controls continue to govern access to those assets.

Getting started

• Read Automatic Identity Management for Entra ID is now generally available on Azure Databricks.

FAQs

What does AIM stand for?

AIM stands for Automatic Identity Management, an account-level just-in-time identity provisioning system on Databricks.

Does AIM grant access to data and dashboards?

No. AIM grants access to the Databricks platform; existing entitlement and sharing controls still govern access to datasets, dashboards, notebooks, and workspaces.

Is AIM generally available?

Automatic Identity Management for Entra ID is generally available on Azure Databricks, and a public preview is underway for AWS with Entra ID.