{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-@l10n/ja/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Step 2: Set Up Databricks Authentication","description":"Create a service principal, generate OAuth secrets, and configure workspace access for Composable Audience Studio.","siteUrl":"https://docs.treasure.ai","lang":"en-US","jsonLd":{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.treasure.ai/","name":"Treasure AI","url":"https://www.treasure.ai/","logo":"https://www.treasure.ai/hubfs/assets/images/logos/primary-logo.svg"},{"@type":"WebSite","@id":"https://docs.treasure.ai/#website","name":"Treasure AI Documentation","url":"https://docs.treasure.ai/","inLanguage":["en","ja"],"publisher":{"@id":"https://www.treasure.ai/"}}]},"llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"step-2-set-up-databricks-authentication","__idx":0},"children":["Step 2: Set Up Databricks Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["CAS connects to Databricks using a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["service principal with OAuth secrets"]},". You will create a service principal, generate OAuth secrets, and configure workspace access."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-a-service-principal","__idx":1},"children":["Create a Service Principal"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the Databricks ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Account Console"]},", navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User management"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service principals"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add service principal"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter a display name for the service principal (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TD-CAS-Service"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add service principal"]}," to create it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Note the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application ID"]}," assigned to the service principal."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"generate-an-oauth-secret-for-the-service-principal","__idx":2},"children":["Generate an OAuth Secret for the Service Principal"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the Databricks ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Account Console"]},", navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User management"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service principals"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the service principal you created in the previous step."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credentials & secrets"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Generate secret"]}," to create it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Note the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]}," values. You will need them in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/ja/products/customer-data-platform/composable-cdp/audience-studio/databricks/configure-databricks-authentication"},"children":["Step 3: Configure Databricks Authentication in Integration Hub"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"allow-the-service-principal-to-access-a-workspace","__idx":3},"children":["Allow the Service Principal to Access a Workspace"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In your Databricks workspace, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workspace admin"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity and access"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service principals"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add service principal"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Search for and select the service principal you created."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add"]}," to grant workspace access."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-schema-level-access-control-if-necessary","__idx":4},"children":["Configure Schema-Level Access Control (If Necessary)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your Unity Catalog has fine-grained access controls, ensure the service principal has the necessary permissions:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Catalog"]}," in the Databricks workspace sidebar."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the target catalog (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cas_demo_east1"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permissions"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Grant"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add the service principal as a principal."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CREATE TABLE"]}," and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data Reader"]}," privilege preset, which grants:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Prerequisite"]},": USE CATALOG, USE SCHEMA"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Metadata"]},": BROWSE"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Read"]},": EXECUTE, SELECT"]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The service principal needs to have ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CREATE TABLE"]}," to create a temporary table for activations."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"allow-treasure-ai-server-ips-to-access-the-cdw","__idx":5},"children":["Allow Treasure AI Server IPs to Access the CDW"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your Databricks workspace uses IP access lists, add Treasure AI's export IP addresses to the allow list. Use the Databricks CLI:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","header":{"controls":{"copy":{}}},"source":"databricks ip-access-lists create --json '{\n  \"label\": \"TreasureAI\",\n  \"list_type\": \"ALLOW\",\n  \"ip_addresses\": [\n    \"<TD_IP_1>\",\n    \"<TD_IP_2>\"\n  ]\n}'\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the list of Treasure AI IP addresses to add, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/endpoints/ip-addresses-integrations-result-workers"},"children":["Static IP Addresses for Integrations and Result Workers"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"legacy-access-with-personal-access-token","__idx":6},"children":["(Legacy) Access with Personal Access Token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Composable Audience Studio also supports Personal Access Tokens (PATs) for Databricks access."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"generate-a-pat-for-the-service-principal","__idx":7},"children":["Generate a PAT for the Service Principal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A workspace admin must create the initial PAT on behalf of the service principal using the Databricks CLI:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set up authentication for the Databricks CLI if not already configured."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Get the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application ID"]}," of the service principal:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click your username in the top bar, then click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workspace admin"]},", click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity and access"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Manage"]}," (next to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service principals"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click the service principal name to open its settings page."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configurations"]}," tab, note the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application Id"]}," value."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Run the following command to generate the access token:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","header":{"controls":{"copy":{}}},"source":"databricks token-management create-obo-token \\\n  <application-id> \\\n  --lifetime-seconds 86400 \\\n  --profile <admin-profile>\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Service principals ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["cannot"]}," create their own initial PAT. A workspace admin must use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["create-obo-token"]}," command. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["databricks tokens create"]}," command will fail with a \"User does not have permission to use tokens\" error."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once the service principal has its first PAT, it can create additional tokens for itself:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","header":{"controls":{"copy":{}}},"source":"databricks tokens create --lifetime-seconds 86400 --profile <sp-pat-profile>\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Databricks recommends using OAuth M2M (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]},") instead of PATs for service principals, as OAuth tokens auto-refresh and are more secure. CAS also supports OAuth M2M — see the main sections above for the recommended setup."]}]}]},"headings":[{"value":"Step 2: Set Up Databricks Authentication","id":"step-2-set-up-databricks-authentication","depth":1},{"value":"Create a Service Principal","id":"create-a-service-principal","depth":2},{"value":"Generate an OAuth Secret for the Service Principal","id":"generate-an-oauth-secret-for-the-service-principal","depth":2},{"value":"Allow the Service Principal to Access a Workspace","id":"allow-the-service-principal-to-access-a-workspace","depth":2},{"value":"Configure Schema-Level Access Control (If Necessary)","id":"configure-schema-level-access-control-if-necessary","depth":2},{"value":"Allow Treasure AI Server IPs to Access the CDW","id":"allow-treasure-ai-server-ips-to-access-the-cdw","depth":2},{"value":"(Legacy) Access with Personal Access Token","id":"legacy-access-with-personal-access-token","depth":2},{"value":"Generate a PAT for the Service Principal","id":"generate-a-pat-for-the-service-principal","depth":2}],"frontmatter":{"seo":{"title":"Step 2: Set Up Databricks Authentication","description":"Create a service principal, generate OAuth secrets, and configure workspace access for Composable Audience Studio."}},"lastModified":"2026-08-14T22:18:35.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/ja/products/customer-data-platform/composable-cdp/audience-studio/databricks/set-up-databricks-authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}