Skip to content

Integrating SailPoint with Databricks

This guide provides instructions for integrating SailPoint with Databricks to centralize identity aggregation, access governance, and automated lifecycle management. Using a service principal with OAuth 2.0 authentication, the SailPoint source interfaces directly with Databricks Account and Workspace APIs. This integration supports comprehensive identity management across both account and workspace levels for a single metastore.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Key Capabilities

The integration provides the following capabilities:

  • Identity Aggregation: Import users, service principals, groups, and membership data.
  • Access Governance: Manage workspace access and automate entitlement assignments.
  • Lifecycle Management: Streamline the provisioning and deprovisioning of identities.
  • Compliance: Automate governance workflows to ensure audit readiness.

Note

Managing multiple metastores requires the configuration of separate application instances within SailPoint.

Supported Features

The SailPoint Databricks source supports the following features:

Authentication and Account Host

  • Databricks custom (vanity) account URLs for account and workspace API routing.

Note

The standard Databricks account hosts and the existing Databricks M2M and Microsoft Entra authentication types remain supported and are unchanged by default.

Account Aggregation

The source aggregates the following objects:

Account Objects

  • Users
  • Service principals

Entitlement Aggregation

The source aggregates the following entitlements:

Groups

  • Databricks groups as groups

Workspace Access

  • Workspace Permission as workspaceEntitlements

Account Roles

  • Connected Account Roles as accountLevelRoles

Group Aggregation

  • Aggregation of Databricks groups with connected permissions aggregated.
  • Aggregation of roles (account level).
  • Aggregation of all workspace access along with permissions.
  • Connected permissions are also aggregated.

Note

"Group Aggregation" is Databricks-specific terminology.

Provisioning Support

User Provisioning

Operation Supported
Create user Yes
Update user Yes
Disable user Yes
Enable user Yes
Delete user Yes
Add/Remove Entitlement Yes

Non-Human Identity Discovery

  • Aggregate Databricks Mosaic AI agents

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Agent Management

The Databricks source supports governance of Mosaic AI Agents (serving endpoints) at the workspace level through Dataset 2.0.

Feature Description
Aggregation of workspace-level agents Discovers and aggregates Mosaic AI agents (serving endpoints) from configured Databricks workspaces. Agents are collected via Dataset 2.0 (databricks:mosaic) and exposed as resources of type std:agent (databricks:mosaic-agent). Aggregated attributes include agent ID, name, creator, timestamps, workspace details, configuration, and operational state.
Activate/Deactivate agent Supports lifecycle management of workspace-level agents through Activate Agent and Deactivate Agent provisioning actions.

Agent Status Mapping

During aggregation, the source normalizes the Databricks agent state object into spStatus (Active or Inactive) using the fields below.

spStatus Ready
Active READY
Inactive NOT_READY

Note

When an agent is activated, Databricks takes approximately 2-3 minutes to fully start it. The activate (start) API returns a success (200) response immediately, but at that point the agent is still starting up and reports ready = NOT_READY with config_update = IN_PROGRESS. For the activate-agent use case only, the connector treats this transitional state as Active, since the agent is on its way to becoming ready.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Prerequisites

Before configuring the source, ensure the following requirements are met:

  • Databricks account is active
  • Identity federation is enabled
  • At least one workspace exists
  • OAuth authentication is allowed
  • You are a Databricks Account Admin
  • Network allows outbound HTTPS to Databricks
  • Firewall allows OAuth token exchange
  • Network allows access to the custom domain and to the standard Databricks account host, if you use a vanity account URL

Configuring the Databricks Connector

Complete the following steps in Databricks before connecting:

Creating a Service Principal

  • Sign in to the Databricks Account Console as an Account Admin.
  • Create Service Principal:
    1. Go to User Management.
    2. Select Service Principals.
    3. Click Add Service Principal.
    4. Enter a name (for example, SailPoint-source).
    5. Select Create.

Assigning Required Roles

  1. Select the service principal.
  2. Open Roles.
  3. Select Assign and select Account admin.
  4. Save.

Generating OAuth Credentials

  1. Open the service principal in the Account Console.
  2. Go to Secrets/Credentials.
  3. Select Generate Secret.
  4. Choose expiration.
  5. Copy the following:
    • Client ID
    • Client Secret

Retrieving Your Account ID

To retrieve your account ID:

  1. Go to the account console.
  2. Select the down arrow next to your username in the upper right corner.

  3. In the drop-down menu, view and copy your Account ID.

    Note

    You must be in the account console to retrieve the account ID. The ID will not display inside a workspace.

For more information, refer Databricks Account Settings Documentation.

Retrieving Your Metastore ID

For more information on retrieving your metastore ID, refer Find Your Metastore ID.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

The source requires a dedicated Databricks service principal with administrative privileges.

Note

The service account must have admin permissions on all workspaces you want to manage in the source environment.

Minimum Required Roles

Role Scope
Account Admin Account

Generate Client ID and Client Secret for Azure Authentication

Register the Application in Azure Portal

The client ID is the unique identifier for your registered application. To register the application:

  1. Sign in to the Azure Portal.
  2. Search for and select Microsoft Entra ID (formerly Azure Active Directory).
  3. In the left sidebar, select App registrations > + New registration.
  4. Enter a name for your application (for example, Databricks-Automation), and then select Register.
  5. On the Overview page, copy the Application (client) ID. This is your client ID.

Generate the Client Secret

The client secret is the password your application uses to authenticate. To generate the client secret:

  1. In your registered app’s menu, select Certificates & secrets.
  2. Select + New client secret.
  3. Enter a description, choose an expiration period, and then select Add.
  4. Immediately copy the Value (not the Secret ID).

Important

The client secret value is displayed only once and cannot be retrieved later. Store it securely.

Add the Service Principal to Databricks

After you generate credentials, you must authorize this identity in your Databricks workspace. To add the service principal:

  1. Sign in to your Azure Databricks workspace.
  2. Select your username in the upper right corner, and then select Settings.
  3. Go to Identity and access > Service principals > Manage.
  4. Select Add service principal > Add new.
  5. Paste the Application (client) ID that you copied from the Azure Portal, and then enter a display name.
  6. Select Add.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.