Configure authentication to Microsoft Entra ID

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Entra ID from the Previews page. See Manage Databricks previews.

This page shows how to configure Microsoft Entra ID to enable authentication from Databricks for the Microsoft Entra ID connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Databricks.

Prerequisites

• To register the application, you must have at least the Application Developer role. To add Microsoft Graph application permissions, you must have at least the Cloud Application Administrator role. See Register an application in Microsoft Entra ID and Configure app access to web APIs.
• To grant admin consent for Microsoft Graph application permissions, you must have the Privileged Role Administrator role. See Grant tenant-wide admin consent to an application.
• The signins table, and the signInActivity column of the users table, require a Microsoft Entra ID P1 or P2 license. See Prerequisites to access the Microsoft Entra reporting API and List users.
• The role_eligibility_schedule table reads Privileged Identity Management (PIM) data. Using PIM requires licenses. See What is Privileged Identity Management?.

Configure Microsoft Entra ID

Register an application in Microsoft Entra ID, create a client secret, and grant the application Microsoft Graph application permissions. Databricks uses the application's credentials to authenticate with the client credentials flow.

Register an application

1. Sign in to the Microsoft Entra admin center.
2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant that you want to ingest.
3. Browse to Entra ID > App registrations and select New registration.
4. Enter a Name for the application.
5. Under Supported account types, select Single tenant only - <your tenant>.
6. Select Register.
7. On the application's Overview page, record the Application (client) ID and the Directory (tenant) ID.

See Register an application in Microsoft Entra ID.

Create a client secret

1. In App registrations, select your application.
2. Select Certificates & secrets > Client secrets > New client secret.
3. Add a description for the client secret.
4. Select an expiration for the secret, or specify a custom lifetime.
5. Select Add.
6. Record the client secret Value. Microsoft Entra ID doesn't display this value again after you leave the page.

See Add credentials to an application.

Grant Microsoft Graph application permissions

1. In App registrations, select your application.
2. Select API permissions > Add a permission > Microsoft Graph > Application permissions.
3. Select the permissions for the tables you plan to ingest. For the full list, see Required OAuth permissions.
4. Select Add permissions.
5. Select Grant admin consent for <your tenant>, then confirm the consent action.

See Configure app access to web APIs.

Identify your Microsoft cloud

Record the Microsoft cloud that hosts your tenant. The connection supports the following values for Microsoft Cloud Region:

• commercial: Microsoft global service.
• us_gov_gcc_high: US Government L4 (GCC High).
• us_gov_dod: US Government L5 (DoD).
• china_21vianet: Microsoft Azure operated by 21Vianet.

See National cloud deployments.

Next steps

Create a Microsoft Entra ID connection in Databricks. See Create a Microsoft Entra ID connection.