# Databricks authentication

> Connect UiPath to a Databricks workspace using OAuth 2.0 client credentials with a Databricks OAuth service principal or a Microsoft Entra ID service principal.

## Prerequisites

The Databricks connector authenticates as a service principal using OAuth 2.0 client credentials (machine-to-machine). Two kinds of service principal are supported:

* A **Databricks OAuth service principal**, managed in the Databricks account console.
* A **Microsoft Entra ID service principal**, for Azure Databricks workspaces.

To create a connection, you need the following values:

| Field | Description |
| --- | --- |
| Workspace Host | Workspace hostname only, without `https://` or a trailing slash. For example, `adb-1234567890123456.7.azuredatabricks.net`. |
| Client ID | The service principal's Application ID (UUID). |
| Client Secret | An OAuth secret generated for that service principal. This is not a personal access token. |
| OAuth Token URL | The token endpoint. Defaults to `https://{workspace.host}/oidc/v1/token`. |
| OAuth Scope | The requested scope. Defaults to `all-apis`. |

## Retrieving your credentials

1. Extract the **Workspace Host** from your Databricks workspace URL. For example, in `https://adb-1234567890123456.7.azuredatabricks.net/browse/folders/workspace`, the workspace host is `adb-1234567890123456.7.azuredatabricks.net`.
2. In the Databricks account console, go to **User management > Service principals** and create a service principal, or select an existing one.
3. Copy the service principal's **Application ID (UUID)** — this is the **Client ID**.
4. On the service principal, go to **Secrets > Generate secret** and copy the generated OAuth secret — this is the **Client Secret**. The secret is shown only once.

   :::important
   Use an OAuth secret, not a personal access token. Personal access tokens are not supported by this connector.
   :::
5. Grant the service principal access to the workspace and to every object your automation uses, such as the SQL warehouse, jobs, Unity Catalog securables, volumes, Genie spaces, and Vector Search indexes.

For more information, see [OAuth machine-to-machine (M2M) authentication](https://docs.databricks.com/dev-tools/auth/oauth-m2m.html) and [Manage service principals](https://docs.databricks.com/admin/users-groups/service-principals.html) in the Databricks documentation.

:::note
The default **OAuth Scope** of `all-apis` lets the token reach every API the service principal is authorized for. Databricks also supports scoped OAuth secrets, which restrict a secret to a specific set of API scopes such as `sql`, `jobs`, or `unity-catalog`. If you use one, the scope must still cover every Databricks API your automation calls, or those activities fail at runtime.
:::

## Add the Databricks connection

1. Select Orchestrator from the product launcher.
2. Select a folder, and then navigate to the **Connections** tab.
3. Select **Add connection**.
4. To open the connection creation page, select the connector from the list. You can use the search bar to find the connector.
5. Enter the **Workspace Host**, **Client ID**, and **Client Secret**.

   Where available, select the menu next to a field and choose **Use credential asset** or **Use Orchestrator asset** to reference an Orchestrator asset instead of entering the value directly. For more information, see [Use credential assets for connections](credential-store-connections.md).

   If you are using a Microsoft Entra ID service principal, update **OAuth Token URL** and **OAuth Scope** as described in [Use a Microsoft Entra ID service principal](#use-a-microsoft-entra-id-service-principal). Otherwise, leave both fields at their defaults.

6. Select **Connect**.

Your Databricks connection has now been added and is available for use in UiPath Studio or Studio Web.

## Use a Microsoft Entra ID service principal

If you authenticate with a Microsoft Entra ID service principal instead of a Databricks OAuth service principal, change **OAuth Token URL** and **OAuth Scope** as follows:

1. Replace the **OAuth Token URL** entirely with the Microsoft identity platform token endpoint:

   ```
   https://login.microsoftonline.com/{your-azure-tenant-guid}/oauth2/v2.0/token
   ```

   :::important
   Substitute your literal Azure tenant GUID into the URL. Do not leave `{your-azure-tenant-guid}` as a placeholder.
   :::

2. Set **OAuth Scope** to the Azure Databricks resource ID followed by `/.default`:

   ```
   2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/.default
   ```

   :::note
   Unlike the tenant GUID in the token URL, this GUID is not a placeholder. `2ff814a6-3304-4ab8-85cb-cd0e6f879c1d` is the fixed identifier for Azure Databricks across all Azure environments, so enter it exactly as shown.
   :::

For more information, see [Get Microsoft Entra ID tokens manually](https://learn.microsoft.com/en-us/azure/databricks/dev-tools/service-prin-aad-token) and [Authenticate with Microsoft Entra service principals](https://learn.microsoft.com/en-us/azure/databricks/dev-tools/auth/azure-sp) in the Azure Databricks documentation.

:::note
The connection is only as capable as the service principal behind it. A connection can be created successfully and still fail at runtime if the service principal lacks permissions on the object an activity targets.
:::