DP-750 · 2.1.4 · Secure and govern Unity Catalog objects
Service principal auth
Authenticate data access by using service principals
Use service principals with OAuth for unattended Databricks automation instead of relying on a human identity.
Place the service principal in the identity model
A service principal is a non-human Databricks identity that can be assigned to workspaces and governed like other identities. The diagrams below focus on the authentication flow and credential choices.
Use a machine identity
- 1Service principalNon-human automation identity
- 2OAuth secretClient credential
- 3Access tokenShort-lived authentication
- 4Databricks resourceAPI, job, SQL, or workspace action
Service principals are the right identity for unattended automation such as CI/CD pipelines, scheduled integrations, and API clients.
Authentication is not authorization
- Resource permissionsWhat the identity may use
- EntitlementsWhich Databricks capabilities are available
- OAuth tokenProves the service principal identity
A valid token does not automatically grant access to clusters, warehouses, APIs, or Unity Catalog data.
Scope credentials narrowly
Use scoped OAuth secrets where supported and grant only the permissions the automation needs. A dedicated service principal is easier to audit, rotate, disable, and separate from human access.
Key points
- Service principal: Non-human identity for automation
- OAuth M2M: Client credentials obtain access tokens
- Permissions: Grant only resources the automation needs
- Rotation: Manage client secrets when used
Exam trap
A service principal still needs explicit Databricks entitlements and resource permissions.
Sources · 1 Microsoft Learn page Show ▾
Checked on October 4, 2026. Report a problem
Go deeper on Microsoft Learn
Checked against Microsoft Learn on October 4, 2026. Report a problem with this card