> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Databricks

> Connect your Databricks account to Oleria to continuously discover users, groups, Unity Catalog access, and job-run activity across every workspace.

Databricks is a data and AI platform used for analytics, machine learning, and data engineering. Connect your Databricks account to Oleria to bring users, groups, Unity Catalog resources and grants, workspace-object permissions, secret-scope access, credentials, and job-run activity into your identity and access graph, across every workspace in the account.

## What Oleria discovers

* User accounts and profile attributes, synced at the account level.
* Groups and their memberships.
* Unity Catalog resources and grants, workspace-object permissions, secret-scope access, and credentials.
* Job-run activity across every workspace in the account.

Oleria uses this data for dormant account detection and access reviews, synced across every workspace in the account on the standard sync schedule, not just the workspace you connect from.

## Prerequisites

* Access to the Databricks account console with permission to create a service principal and grant account-level roles.
* The account ID for your Databricks account.
* Admin access on the Oleria platform to add a new integration.

## Create a service principal in Databricks

<Steps>
  <Step title="Create a service principal and OAuth secret">
    In the Databricks account console, create a service principal and generate an OAuth client secret for it. Save the **Client ID** and **Client Secret** - you'll need both in Oleria.

    <Note>
      Databricks shows the client secret only once, when you generate it. Regenerate it from the service principal's page if you lose it.
    </Note>
  </Step>

  <Step title="Grant account_admin at the account level">
    Grant the service principal `account_admin` at the account level. Workspace-level admin access alone isn't sufficient for account-wide SCIM and Unity Catalog metastore APIs.
  </Step>

  <Step title="Assign workspace-level access to each workspace">
    Assign the service principal workspace-level access to every workspace you want Oleria to read. Granting `account_admin` doesn't do this automatically - add the service principal to each workspace separately.
  </Step>
</Steps>

## Connect Databricks to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations**, then select the **Databricks** tile.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and fill in the connection form:

    | Field         | Notes                                                                                                                                                                                                                                           |
    | :------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Workspace URL | Required. The home workspace's REST API host, for example `dbc-xxxxxxxx-xxxx.cloud.databricks.com` or `adb-xxxx.azuredatabricks.net`. No scheme and no trailing slash. Oleria fans this connection out to every other workspace in the account. |
    | Account ID    | Required. Your Databricks account ID, found in the account console under your username.                                                                                                                                                         |
    | Client ID     | Required. The OAuth service principal's application ID.                                                                                                                                                                                         |
    | Client Secret | Required. The OAuth secret generated for the service principal.                                                                                                                                                                                 |
  </Step>

  <Step title="Save the integration">
    Select **Connect** to validate the credentials and save the integration.
  </Step>
</Steps>

## Verify the integration

Confirm the new instance appears in your Oleria workspace under **Connected Integrations** with a status of **Healthy**. Oleria syncs users, groups, Unity Catalog access, and job-run activity from every workspace in the account on the standard sync schedule once the initial sync completes.

<Note>
  If a workspace is missing from Oleria's results, confirm the service principal has been explicitly added to that workspace. Account-level `account_admin` alone doesn't grant workspace-level access.
</Note>

## Governance actions

Oleria can also invoke lifecycle actions in Databricks using the same service principal:

* Enable or disable a user account
* Add or remove a user from a group

<Note>
  These actions require the service principal to hold `account_admin` at the account level - the same permission used for discovery. There's no separate read-only tier for this integration.
</Note>

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).