Connect Genie One to external tools and sources

Connect external data sources to a chat conversation in Genie One to search your company documents and data when answering questions. Each user authenticates individually. OAuth tokens are not shared between users.

These connections use Databricks-provided MCP connectors, so there's no server to host and no OAuth app to register. Databricks governs every connection through Unity Catalog and Unity Gateway. The gateway authorizes each tool call against your Unity Catalog permissions, applies built-in policies and approval requirements, and records usage and audit logs in system tables. See External MCP servers.

Supported connections include:

• Google Drive: Search and create Google Docs, Sheets, and Slides; edit Docs it created.
• Gmail: Search, read, and draft email.
• Google Calendar: Search and create calendar events.
• Microsoft 365: Search SharePoint, Teams, Outlook, and Calendar; draft Outlook email.
• Atlassian: Search and update Jira and Confluence.
• Glean (Beta): Search across your organization's connected apps using Glean.
• Slack: Search Slack messages and channels, and send messages.
• GitHub: Search and update repositories, issues, and pull requests.

note

To use these connectors in a Genie Agent instead of Genie One, see Connect a Genie Agent to external tools and sources.

Connect an external data source

1. On the Genie One home page, click the plus icon at the bottom left of the search bar.

2. Select a data source.

   To connect additional data sources, click More connections at the bottom of the list. You can create a custom MCP Service in Unity Catalog. See External MCP servers.

3. Click Sign in and complete the steps to sign in.

The connection is added to your conversation. Chat can now search your documents when answering questions. See Share an MCP.

note

Data source tools might not always trigger automatically. If document search doesn't start, try explicitly prompting chat to use the tool, for example "use Google Drive" or "use SharePoint."

Write actions

Some connected MCP tools can perform write actions in the source application, not just search and read data. Whether a connection can write, and which actions it can take, depends on the tool, the OAuth scopes you consent to when you connect, and your own permissions in the source application.

OAuth scopes

When you connect an external data source, its provider prompts you to consent to a set of OAuth scopes. Scopes define the maximum set of actions a connection can attempt on your behalf. Each user consents individually, and the content a connection can access still depends on how your organization configures the connection and on your own permissions in the source application.

Databricks manages the OAuth credentials for these connections. For the full list of scopes each managed OAuth provider requests and the purpose of each scope, see Managed OAuth providers. The exact set of scopes requested for a connection appears on the provider's consent screen when you connect.

For compliance guidance for connected applications, see External provider requirements.

Limitations

External connections are only available in regions where Unity Gateway is supported.

See supported regions.

Scheduled tasks and authentication

• Chat doesn't warn you when a connection's authentication expires. You might only find out when a tool call fails or when you open the connections list. Re-authenticate to resolve.
• Changing a connection's permissions requires each user to re-authenticate. Scheduled tasks that use the connection fail until the user re-authenticates.

Google Drive

• When authorizing Google Drive, you might see an Unverified app screen. Click Advanced and continue the authorization process.
• Maximum file size is 25 MB.
• Only native Google Workspace files (Docs, Sheets, Slides) are supported. PDFs, images, and other binary formats are not supported.
• The connector can create Google Docs, Sheets, and Slides, and edit Google Docs it created. It can't edit Docs created outside the connector, or edit existing Sheets or Slides.
• Reading a very large document can be slow.

note

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API services User Data Policy, including the Limited Use requirements.

Gmail

• The connector can search, read, and draft email, but it can't send email or edit existing messages.
• The connector can't add Drive files as native Gmail attachments. As a workaround, include links to the files in the email body.

Microsoft 365

• Includes SharePoint, Teams, Outlook, and Calendar.
• The connector can draft Outlook email but can't send it.
• Maximum file size is 25 MB for SharePoint files.
• Supported SharePoint file types include built-in SharePoint documents, spreadsheets, and presentations, as well as common text-based formats such as .txt, .csv, .json, .md, and others. PDFs, images, and other binary formats are not supported.

Glean (Beta)

• Glean is search-only. It can't read a document from a direct link.
• A metastore admin must first configure the Glean tenant ID before non-admin users can use the connection. The admin can enter the tenant ID when first connecting to Glean.
• To connect to a specific Glean MCP server, a metastore admin can optionally set the MCP server path (for example, /mcp/eng) when setting up the connection. Leave this field blank to use the default path (/mcp/default). Non-admin users cannot specify or change the Glean MCP server path.

Slack

• The connector can't edit or delete a message after sending it.

GitHub

• Writes are limited to file contents, issues, and pull requests.
• By default, the Databricks GitHub MCP connector can access only public repositories. To give the connector read access to your private enterprise repositories, a GitHub organization admin must complete additional setup. See GitHub private repositories.
• GitHub Enterprise Server (the self-hosted version of GitHub) is not supported.

Custom MCP Service

Create the MCP Service before adding it to a chat conversation. If the service uses per-user OAuth, each user must sign in before using it. See External MCP servers.