Databricks

Connect Databricks to Trustle to get insight into over-privileged and unused accounts, and to adopt just-in-time access management.

Prerequisites

• Account admin role in Databricks, to access the User Management panel.

Configure Databricks

Step 1: Log in to the Databricks console

Log in with the account admin role. You need this role to access the User Management panel.

Step 2: Create the service principal for Trustle

Note

This flow works only for Databricks-managed service principals. A Microsoft Entra ID service principal has its own flow.

1. Go to the account management console. Open the Workspace dropdown, then click Manage account.

   

2. Go to User Management in the sidebar.

   

3. Go to the Service Principals tab.

   

4. Create the Trustle service principal account.

5. Give the Account Admin role to the service principal (Service Principal → Roles). Trustle needs this role to read account-level identity data: users, groups, and service principals.

   

6. Generate the OAuth secrets (Service Principal → Credentials & Secrets → OAuth Secrets).

   1. Set a lifetime for the secret. 320 days is common.
   2. Copy the Secret and the Client ID. You use both in the Trustle connection.

   

Step 3: Grant the service principal metastore admin

Caution

Account Admin does not grant visibility into Unity Catalog objects. {catalog}.information_schema only returns rows for objects the querying principal can see. For Trustle to discover all catalogs, schemas, tables, views, and grants, the service principal must be a metastore admin.

The metastore admin is a single owner “slot.” Assign it to a group so multiple admins can coexist without overwriting each other.

1. Create an account-level group, for example metastore-admins, if you don’t already have one.

   

2. Add the Trustle service principal to the group.

3. Go to the target metastore (Account console → Catalog, then open the metastore you want to add the admin group to).

   

4. Assign the group as the metastore admin.

   

Step 4: Collect the workspace URL and SQL warehouse ID

Trustle runs its Unity Catalog discovery queries through a SQL warehouse in one of your workspaces.

1. Workspace URL: Go to Account console → Workspaces, then open the workspace you want Trustle to use. Copy its URL, for example https://dbc-xxxxxxxx-xxxx.cloud.databricks.com, or your Azure or GCP equivalent.
2. SQL Warehouse ID: In that workspace, go to SQL → SQL Warehouses, then open the warehouse. The ID is in Connection details. You can also find it in the URL, at /sql/warehouses/<warehouse-id>.
3. Grant the service principal access to the warehouse. On the warehouse, go to Permissions and confirm the Trustle service principal has Can use.

Step 5: Collect the account ID

Open the user menu in the top-right corner of the account console and click Copy account ID. The account ID is a UUID. You can also find it in the console URL.

Step 6: Collect the account host

Copy the account management URL from Step 2 above.

Cloud	Account Host
AWS	https://accounts.cloud.databricks.com
GCP	https://accounts.gcp.databricks.com
Azure	https://accounts.azuredatabricks.net

Connect in Trustle

1. Go to the Connections page in Trustle from the left menu.
2. Under Identity Providers, find the Databricks logo and click Connect.
3. Fill in the connection form:
   1. Connection Name: a descriptive name, for example “My Databricks Connection”.
   2. Account Host: the host you collected above.
   3. Account ID: the account ID you collected above.
   4. Client ID: the client ID from the service principal setup.
   5. Client Secret: the client secret from the service principal setup.
   6. Workspace Host: the workspace URL you collected above.
   7. SQL Warehouse ID: the warehouse ID you collected above.
4. Click Test Connection.
5. After the connection test succeeds, click Save Connection.