🤖 Databricks Authentication Patterns

Automatic Auth (Service Principal)

Pattern 1: How Databricks AI products execute with a fixed service principal identity for automated jobs and consistent permissions.

📖 OAuth M2M Documentation
↓ Scroll to explore the flow
1

Job Triggers Execution

A scheduled job or workflow initiates the AI product — no human user is involved in this request.

Common triggers: cron schedules, CI/CD pipelines, event-driven workflows

2

Service Principal Identity

The AI product runs as a Service Principal (sp-agent-prod) — a non-human identity with predefined permissions.

Databricks automatically manages short-lived OAuth credentials for the SP.

3

OAuth M2M Token

The OAuth server validates the SP and issues a scoped access token (Machine-to-Machine flow).

Token lifetime: 1 hour, auto-renewed, no manual rotation needed.

4

Unity Catalog Query

The AI product queries Unity Catalog as the Service Principal.

UC checks: Does sp-agent-prod have SELECT on this table?

5

Fixed Permissions

Every execution gets identical permissions — the SP's grants don't change between runs.

All access is logged as sp-agent-prod for audit trails.

Scheduled Job
Cron / Workflow
🤖
Service Principal
sp-agent-prod
🔐
OAuth Server
M2M Token
📊
Unity Catalog
Check SP GRANTs
📁
Data
Fixed Results
🎫 SP Token

Key Takeaways

🤖 No User Involved

Service principals are non-human identities for automation and batch jobs.

🔒 Fixed Permissions

Same permissions every execution — predictable, consistent access.

⚡ Auto-Managed Credentials

Databricks handles token rotation automatically. No secrets to manage.

📋 SP-Level Audit

All actions logged under the service principal name for compliance.

← Back to AI Governance 📄 View Full Docs on GitHub