Configure Databricks permissions

August 14, 2026

Before setting up the Databricks data source for Data Access, configure the underlying data source with the required permissions to allow Data Access to synchronize data objects, accounts, and access controls.

Although you can use individual user credentials to run a Data Access synchronization, we highly recommend that you create a dedicated Databricks service principal.

Steps

To configure Databricks permissions for Data Access:

In the Databricks account console, click User management > Service principals > Add service principal, and then add a service principal.
Configure authentication for the service principal by using one of the following options. Be sure to record the credentials for later use.
- Databricks: Create an OAuth secret for the service principal, and then record the client ID and secret.
- Microsoft Entra ID: Register the service principal as an app in the Azure portal, and then record the application's client ID, client secret, and tenant ID.
- Google Cloud Platform: Create a private key for the Google Cloud service account.
- Personal Access Token (PAT): Create a PAT, and then record the token value. Because you cannot use PATs to automate Databricks account-level functionality, we recommend that you choose another authentication option.
Assign an account admin role to the service principal. This allows the principal to read all users, groups, and service principals at the account level, and manage workspace assignments.
Important When adding the Databricks data source to Data Access, the Account Level Access option is enabled by default. This option determines whether you grant Data Access full administrative access at the account level. Choose one of the following paths based on your organization's security policies:
- Enable account-level access (default): Allows Data Access to automatically discover users, groups, and service principals, and manage workspace assignments. If you choose this path, complete the current step by assigning the account admin role to the service principal.
- Disable account-level access (minimum privilege): Restricts Databricks account-level administrative permissions, which prevents Data Access from managing workspace assignments. If you choose this path, skip the current step, that is, do not assign the account admin role to the service principal. However, when adding the data source to Data Access, you must disable the Account Level Access option and manually provide your Metastore Workspace Pairs by mapping each metastore ID to its corresponding workspace deployment names.
Assign a workspace admin role to the service principal for each workspace that you want to synchronize with Data Access. This allows the principal to manage workspace-level access.

Grant the service principal the required privileges on your catalogs by using one of the following options.

Option Description

Metastore admin (preferred option)

Option	Description
Metastore admin (preferred option)	Assign the metastore admin role to the service principal for each metastore that is included in the synchronization. This allows Data Access to grant itself the required privileges on each catalog as they are needed. The exact privileges that are granted depend on the operation being performed.
Explicit MANAGE privilege	An administrator grants the `MANAGE` privilege to the service principal on each catalog of each metastore that Data Access manages. This still allows Data Access to grant itself the required privileges on those catalogs. If Data Access cannot grant itself the required privileges on a catalog, it skips that catalog with a warning and continues the synchronization for the remaining catalogs. This occurs if Data Access is not the catalog owner, does not have the `MANAGE` privilege, and is not a metastore administrator.

Assign the metastore admin role to the service principal for each metastore that is included in the synchronization. This allows Data Access to grant itself the required privileges on each catalog as they are needed. The exact privileges that are granted depend on the operation being performed.

Explicit MANAGE privilege

An administrator grants the MANAGE privilege to the service principal on each catalog of each metastore that Data Access manages. This still allows Data Access to grant itself the required privileges on those catalogs. If Data Access cannot grant itself the required privileges on a catalog, it skips that catalog with a warning and continues the synchronization for the remaining catalogs. This occurs if Data Access is not the catalog owner, does not have the MANAGE privilege, and is not a metastore administrator.

What's next

Create Databricks connection