Ingest data from Microsoft Entra ID

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Entra ID from the Previews page. See Manage Databricks previews.

This page shows how to create a managed Microsoft Entra ID ingestion pipeline using Lakeflow Connect.

Requirements

To create an ingestion pipeline, first meet the following requirements:
- Your workspace must be enabled for Unity Catalog.
- Serverless compute must be enabled for your workspace. See Serverless compute requirements.
- To create a new connection, you must have CREATE CONNECTION privileges on the metastore. See Manage privileges in Unity Catalog.
  
  If the connector supports UI-based pipeline authoring, an admin can create the connection and the pipeline at the same time by completing the steps on this page. However, if the users who create pipelines use API-based pipeline authoring or are non-admin users, an admin must first create the connection in Catalog Explorer. See Connect to managed ingestion sources.
- To use an existing connection, you must have USE CONNECTION privileges or ALL PRIVILEGES on the connection object.
- You must have USE CATALOG privileges on the target catalog.
- You must have USE SCHEMA and CREATE TABLE privileges on an existing schema or CREATE SCHEMA privileges on the target catalog.
To ingest from Microsoft Entra ID, first configure authentication from Databricks and create a connection. See Configure authentication to Microsoft Entra ID and Create a Microsoft Entra ID connection.

Connector options

Set pipeline-scoped options in source_configurations. All options are optional. See Examples for usage.

Option	Scope	Required	Applies to	Description
`start_datetime`	Pipeline	No	`directoryaudits`, `signins`	Earliest event time to ingest on the first sync, as an RFC 3339 timestamp, for example `2026-09-15T00:00:00Z`. The connector limits the value to between 30 days and 1 day before the sync. Defaults to 30 days before the sync.

Option	Scope	Required	Applies to	Description
`start_datetime`	Pipeline	No	`directoryaudits`, `signins`	Earliest event time to ingest on the first sync, as an RFC 3339 timestamp, for example `2026-09-15T00:00:00Z`. The connector limits the value to between 30 days and 1 day before the sync. Defaults to 30 days before the sync.

Create an ingestion pipeline

For the list of supported source tables, see Supported source tables.

Databricks UI
Declarative Automation Bundles
Databricks notebook

In the sidebar of the Databricks workspace, click Data Ingestion.
On the Add data page, under Databricks connectors, click Microsoft Entra ID.
On the Connection page of the ingestion wizard, select the connection that stores your Microsoft Entra ID credentials. If you have the CREATE CONNECTION privilege on the metastore, click Create connection to create a connection with the credentials from Configure authentication to Microsoft Entra ID.
Click Next.
On the Ingestion setup page, enter a name for the pipeline.
Select a catalog and a schema to write event logs to. If you have USE CATALOG and CREATE SCHEMA privileges on the catalog, click Create schema in the drop-down menu to create a schema.
Click Create pipeline and continue.
On the Source page, select the tables to ingest.
Click Save and continue.
On the Destination page, select a catalog and a schema to load data into. If you have USE CATALOG and CREATE SCHEMA privileges on the catalog, click Create schema in the drop-down menu to create a schema.
Click Save and continue.
(Optional) On the Schedules and notifications page, click Create schedule. Set the frequency to refresh the destination tables.
(Optional) Click Add notification to set email notifications for pipeline operation success or failure, then click Save and run pipeline.

Use Declarative Automation Bundles to manage Microsoft Entra ID pipelines as code. Bundles can contain YAML definitions of jobs and tasks, are managed using the Databricks CLI, and can be shared and run in different target workspaces (such as development, staging, and production). For more information, see What are Declarative Automation Bundles?.

Create a bundle using the Databricks CLI:
Bash
```
databricks bundle init
```
Add two new resource files to the bundle:
- A pipeline definition file (for example, resources/microsoft_entra_id_pipeline.yml). See pipeline.ingestion_definition and Examples.
- A job definition file that controls the frequency of data ingestion (for example, resources/microsoft_entra_id_job.yml).
Deploy the pipeline using the Databricks CLI:
Bash
```
databricks bundle deploy
```

Examples

The Microsoft Entra ID connector makes available 15 source tables in the default source schema. Ingest individual tables or the tables you need.

Ingest specific tables

Use this option to ingest a specific subset of tables, or to customize destination naming per table.

Declarative Automation Bundles
Databricks notebook

The following pipeline definition file ingests individual Microsoft Entra ID tables:

YAML
resources:
  pipelines:
    microsoft_entra_id_pipeline:
      name: microsoft_entra_id_pipeline
      catalog: 'main'
      target: 'microsoft_entra_id_data'
      ingestion_definition:
        connection_name: microsoft_entra_id_connection
        source_configurations:
          - api_source_connector_config:
              configs:
                start_datetime: '<start-datetime>'
        objects:
          - table:
              source_schema: 'default'
              source_table: 'users'
              destination_catalog: 'main'
              destination_schema: 'microsoft_entra_id_data'
              destination_table: 'users'
          - table:
              source_schema: 'default'
              source_table: 'groups'
              destination_catalog: 'main'
              destination_schema: 'microsoft_entra_id_data'
              destination_table: 'groups'
          - table:
              source_schema: 'default'
              source_table: 'signins'
              destination_catalog: 'main'
              destination_schema: 'microsoft_entra_id_data'
              destination_table: 'signins'

The following pipeline specification ingests individual Microsoft Entra ID tables:

Python
pipeline_name = "microsoft_entra_id_pipeline"
connection_name = "<microsoft-entra-id-connection>"
pipeline_spec = {
  "name": pipeline_name,
  "ingestion_definition": {
    "connection_name": connection_name,
    "source_configurations": [
      {
        "api_source_connector_config": {
          "configs": {
            "start_datetime": "<start-datetime>"
          }
        }
      }
    ],
    "objects": [
      {
        "table": {
          "source_schema": "default",
          "source_table": "users",
          "destination_catalog": "main",
          "destination_schema": "microsoft_entra_id_data",
          "destination_table": "users"
        }
      },
      {
        "table": {
          "source_schema": "default",
          "source_table": "groups",
          "destination_catalog": "main",
          "destination_schema": "microsoft_entra_id_data",
          "destination_table": "groups"
        }
      },
      {
        "table": {
          "source_schema": "default",
          "source_table": "signins",
          "destination_catalog": "main",
          "destination_schema": "microsoft_entra_id_data",
          "destination_table": "signins"
        }
      }
    ]
  }
}
json_payload = json.dumps(pipeline_spec, indent=2)
create_pipeline(json_payload)

Declarative Automation Bundles job definition file

The following is an example job definition file for use with Declarative Automation Bundles. The job runs daily.

Declarative Automation Bundles

YAML
resources:
  jobs:
    microsoft_entra_id_job:
      name: microsoft_entra_id_job
      schedule:
        quartz_cron_expression: '0 0 0 * * ?'
        timezone_id: 'UTC'
      tasks:
        - task_key: microsoft_entra_id_ingestion
          pipeline_task:
            pipeline_id: ${resources.pipelines.microsoft_entra_id_pipeline.id}

Common patterns

For advanced pipeline configurations, see Common patterns for managed ingestion pipelines.

Next steps

Start, schedule, and set alerts on your pipeline. See Common pipeline maintenance tasks.

Requirements​

Connector options​

Create an ingestion pipeline​

Examples​

Ingest specific tables​

Declarative Automation Bundles job definition file​

Common patterns​

Next steps​

Additional resources​