Create a Databricks Workspace connection to an Edge or Collibra Cloud site

Tip 
• You can also integrate the metadata of Databricks databases, schemas, tables, database views, and columns using the Databricks Unity Catalog metadata integration. For more information, go to the Databricks Unity Catalog documentation.
• If you're looking for information on how to create technical lineage for Databricks Unity Catalog via Edge, go to the technical lineage for Databricks Unity Catalog documentation.

Prerequisites

In your Collibra environment

• You either created and installed an Edge site or were granted a Collibra Cloud site.
If you want to add connection values from a vault, you have added the vault to your Edge site. If your data source connection requires a file from your vault, the file must be encoded into Base64 and stored as a regular secret in your vault. For more information, go to the Vault documentation.
Note  Vaults are not supported on Collibra Cloud sites.
• You have a global role that has the Manage connections and capabilities global permission, for example, Edge integration engineer.

In your Databricks environment

AI ingestion

The integration identity (personal access token, OAuth client, or service principal) needs two kinds of permissions.

• Databricks recommends using OAuth instead of personal access tokens (PAT). If you're using a PAT, create a scoped token and assign the following API scopes:
  • unity-catalog
  • mlflow
  • model-serving
  • knowledge-assistants
  • supervisor-agents
  • genie
  For more information, go to the Databricks documentation.
• Unity Catalog privileges: These are inherited, granting them at the catalog level covers all current and future schemas and objects within it. Grant the following: 
  • BROWSE on the catalogs in Unity Catalog from which you want to integrate metadata. For more information on the BROWSE privilege, go to the Databricks Unity Catalog documentation. This also covers the catalogs containing:
    • The inference tables that are required to support AI Monitor ingestion when an AI Gateway inference table is configured.
    • The metadata for AI input datasets that you want to integrate.
  • EXECUTE or READ METADATA on registered models (granting this permission at the catalog or schema level covers all models within).
  • USE CATALOG on the parent catalog.
  • USE SCHEMA on the parent schema.
• Workspace object permissions: Objects are governed by workspace access control lists and permissions aren't inherited. Grant each of the following permissions per object or make the integration identity a workspace admin:
  • CAN_VIEW on serving endpoints to list serving endpoints.
  • CAN_READ on the MLflow experiments to read runs used for AI Monitor or metric ingestion. This permission is optional for model ingestion. Without it, model versions are ingested but without their run attributes.
  • CAN_MANAGE on AI agents you want to integrate. This permission is required to read an agent's configuration. CAN_QUERY and CAN_VIEW are not sufficient, they allow querying the agent endpoint but not reading its configuration.

  Serving endpoints, experiments, and AI agents use per-object workspace permissions with no inheritance, so the integration can only discover objects that are shared with its identity. To keep the registry complete as new objects are created, add the integration identity to the workspace admins group. Workspace admins automatically receive the required permission on all objects of these types. If your organization does not allow service principals in the admins group, you must grant the per-object permissions listed above through an automated provisioning process instead. Any object that the process misses will be absent from the registry without error.

Steps

1. Open a site.
   1. On the main toolbar, click → Settings.
      The Settings page opens.
   2. In the tab pane, click Edge.
      The Sites tab opens and shows a table with an overview of your sites.
   3. In the table, click the name of the site whose status is Healthy.
      The site page opens.
2. In the Connections section, click Create connection.
3. Select Databricks Workspace to connect to Databricks.
   The Create connection page appears.
4. Enter the required information.

   Field	Description	Required	Available for Vaults?
   Name	The name of the Edge or Collibra Cloud site connection for Databricks.	Yes	No
   Description	The description of the connection.	No	No
   Vault	The vault where you store your data source values.	No	No
   Workspace URL	Enter the URL of any Databricks workspace connected to Unity Catalog that you want to integrate. To retrieve the URL, log into Databricks and copy the URL. For example: https://123.cloud.databricks.com.	Yes	Yes
   Authentication Type	Select the type of authentication that you want to apply. You can select any of the following values: Personal Access Token OAuth For information on OAuth-based authentication in Databricks Unity Catalog, go to the Databricks documentation. Microsoft Entra ID For information, go to Microsoft Entra service principal authentication in the Azure Databricks documentation. The Microsoft Entra ID authentication option supports Azure Public, Azure China, and Azure US Government. Azure Germany is not supported.	Yes	No
   Access Token	The security token that was generated in Databricks for the workspace. The access token must be a personal access token (PAT). It is possible to generate a PAT for service principals. For information on the service principal token, go to the Databricks documentation. Note Ensure that your Databricks access token has been granted the required permissions in your Databricks environment.	Yes, if you select Personal Access Token as the authentication type.	Yes
   Client ID	The client ID for OAuth-based authentication in Databricks, or the client ID of the Microsoft Entra ID service principal. For information on OAuth-based authentication in Databricks Unity Catalog, go to the Databricks documentation. For information on the Microsoft Entra ID service principal, go to Microsoft Entra service principal authentication in the Azure Databricks documentation. Note Ensure that your Databricks OAuth client or Microsoft Entra ID service principal has been granted the required permissions in your Databricks environment.	Yes, if you select OAuth or Microsoft Entra ID as the authentication type.	No
   Client Secret	The client secret generated for the OAuth-based authentication on Databricks, or the client secret of the Microsoft Entra ID service principal.	Yes, if you selectOAuth or Microsoft Entra ID as the authentication type.	No
   Tenant ID	The Directory (tenant) ID for the related application registered in Microsoft Entra ID. For information, go to Microsoft Entra service principal authentication in the Azure Databricks documentation.	Yes, if you select Microsoft Entra ID as the authentication type.	No
   Azure Environment	The Azure cloud that hosts your Microsoft Entra ID tenant. The integration uses this value only if you select Microsoft Entra ID as the authentication type. Select one of the following: PUBLIC: Global Azure. This is the default option. CHINA: Azure China. USGOV: Azure US Government.	No	No

5. Click Create.
   The connection is added to the Edge or Collibra Cloud site.

Collibra validates the credentials when synchronizing Databricks Unity Catalog.

What's next

Add the Databricks Unity Catalog capability to your Edge or Collibra Cloud site.