Databricks ABAC Setup

This guide outlines the prerequisites and configuration steps required to enable SaaS Authorization Management for Databricks ABAC using PlainID.

The Databricks ABAC integration supports Learn Mode. For an overview of the integration and what PlainID discovers, refer to Databricks ABAC.

Prerequisites

PlainID POP Service Principal Ensure that you have a PlainID POP Service Principal. You must assign it to PlainID and grant it sufficient privileges to perform discovery in Databricks.

To create a PlainID POP Service Principal:

Create a dedicated PlainID POP Service Principal in Databricks.
- Generate an OAuth secret for the Service Principal. PlainID uses the Service Principal's Client ID and Client Secret to authenticate.
- Grant it the privileges listed under Privileges for Learn Mode.

For more information, see Service Principals in Databricks.

Required Privileges

Grant all required privileges either directly to the Service Principal or to a group it is a member of.

The Service Principal must have access to the Databricks workspace where you intend to discover Policies.

Privileges in Databricks are hierarchical and inherited. When you grant a privilege on a Catalog, it automatically applies to all existing and future objects in that Catalog.

Grant the privileges at the Catalog level. PlainID does not support privileges granted at the Schema or Table level. If you grant them at those levels, the test connection fails, even when the access would otherwise be sufficient.

Privileges for Learn Mode

To use Learn Mode, grant the following privileges in Databricks:

Privilege	Purpose
CATALOG: `USE CATALOG`	Grants the ability to reference objects within the Catalog.
CATALOG: `USE SCHEMA`	Grants the ability to reference Schemas, Tables, and functions within the Catalog.
CATALOG: `BROWSE`	Grants the ability to view object metadata. PlainID uses this to verify connectivity.
CATALOG: `SELECT`	Grants the ability to read Tables and their Columns.
CATALOG: `EXECUTE`	Grants the ability to read the UDFs that row filter and column mask Policies reference.
CATALOG: `MANAGE`	Grants the ability to read ABAC Policies. Databricks requires `MANAGE` to view Policies. PlainID does not create, update, or delete Policies in Learn Mode.
Governed Tag: `ASSIGN`	Grants the ability to read Governed Tags. This is an account-level permission you grant in the Databricks Account Console, not with a SQL `GRANT` statement.

Note: You must grant MANAGE explicitly. ALL PRIVILEGES does not include MANAGE, so a Service Principal that has only ALL PRIVILEGES fails the test connection.

To grant the Catalog-level privileges, run the following in Databricks:

GRANT USE CATALOG, USE SCHEMA, BROWSE, SELECT, EXECUTE, MANAGE
ON CATALOG <catalog_name>
TO `<service_principal_application_id>`;

Then grant ASSIGN on each relevant Governed Tag from the Databricks Account Console.

Refer to the official Databricks documentation for more information on Unity Catalog privileges and ABAC Policies.

Creating a Databricks ABAC Policy Orchestration Point (POP)

Once you configure the POP Service Principal with the required privileges, ensure you have the following:

An Integrations Workspace (formerly Orchestration Workspace). To create one, refer to Managing Workspaces.
A linked Policies Workspace (formerly Authorization Workspace). This link is required.
A linked Identity Workspace. This link is required. POP creation fails without it.
A Databricks ABAC POP. Refer to Managing POPs to create one, and select Databricks ABAC as the vendor.

PlainID creates the POP in Learn Mode and automatically creates an Application and Scope for it in the linked Policies Workspace. The Scope takes the name of the POP.

Connection Settings

To connect Databricks ABAC to PlainID, define the following connection fields:

Connection Field	Description
Authentication Method	Use a Service Principal for the Databricks ABAC integration.
Secret Store	The Secret Store where your credentials are stored. Databricks ABAC supports the PlainID Internal Store.
Host	The base URL of your Databricks workspace (e.g., `https://<workspace-name>.cloud.databricks.com`, or `https://<workspace-name>.azuredatabricks.net` for Azure). You can only set this field when you create the POP.
Client ID	The unique identifier of the Service Principal. You can only set this field when you create the POP.
Client Secret	The OAuth secret associated with the Client ID. PlainID masks this value.

Discovery Scope

Define the Catalog that PlainID discovers under Discovery Scope, in the format Catalog equals <catalog_name>.

This field is required. Each POP discovers one Catalog.
You can only set this field when you create the POP.
The Catalog name can contain up to 100 characters.
You cannot use system Catalogs (samples, system, hive_metastore).

Test Connection

PlainID runs a test connection in the following cases:

When you create the POP.
When you update the POP and change its credentials, for example, when you rotate the Client Secret.
When you run Test Connection manually.

The test verifies that PlainID can reach your Databricks workspace, authenticate with the Service Principal, and confirm the required Catalog privileges. It also checks that the Service Principal can list Governed Tag Policies.

PlainID checks the Catalog first. If that check fails, the test stops immediately. Otherwise, PlainID checks the privileges. If any single privilege is missing, the test connection fails and PlainID does not create the POP.

Error	What to do
Connection error	PlainID could not reach or authenticate with the Databricks workspace. Verify the Host URL and that the workspace is available. Verify the Client ID and Client Secret, and confirm the OAuth secret is active.
Missing privileges	Grant each listed privilege to the Service Principal at the Catalog level, then retry.
No catalogs are visible with the supplied credentials.	Either no Catalogs are visible at all, or the configured Catalog is not visible. Grant `USE CATALOG` and `BROWSE` on the Catalog, and confirm the Catalog name.
Invalid input	The connection settings contain a value PlainID cannot accept, for example, more than one Catalog. Correct the value and retry.

Discovery in PlainID

After PlainID creates the POP, it discovers the following objects from Databricks:

Object	Details
Catalogs	The Catalog defined in the Discovery Scope.
Schemas	All Schemas in the Catalog, except `information_schema`.
Tables	Managed Tables, external Tables, streaming Tables, materialized views, and shallow clones in each Schema, including their Columns. PlainID does not discover views, metric views, or foreign Tables.
Governed Tags	Governed Tags assigned to Tables. PlainID does not discover Column, Schema, or Catalog tags, or a tag's allowed values.
Row Access Policies	ABAC row filter Policies defined at the Catalog, Schema, or Table level. PlainID discovers each Policy once, at the level where it is attached.
Masking Policies	ABAC column mask Policies defined at the Catalog, Schema, or Table level. PlainID discovers each Policy once, at the level where it is attached.
UDFs	The functions that discovered Policies reference.

Known Limitations

Each Databricks ABAC POP discovers one Catalog. To discover additional Catalogs, create a POP for each one.
PlainID does not discover GRANT Policies.
If a Policy references a non-SQL UDF (for example, a Python UDF), PlainID discovers the Policy without its UDF section. The rest of the Policy is discovered as usual.
PlainID skips objects that the Service Principal cannot access and logs a warning. Discovery still completes.
PlainID does not support renaming a Databricks Catalog after you configure the POP. After a rename, discovery fails because PlainID can no longer find the configured Catalog. You cannot edit the Catalog on an existing POP, so create a new POP for the renamed Catalog.