External services with managed OAuth
Databricks offers managed OAuth flows for select API tool providers. You don't need to register your own OAuth app or manage credentials. Databricks recommends Managed OAuth for development and testing. If production use cases require generating custom OAuth credentials, see the providers' documentation for more information.
Requirements
Create a Unity Catalog HTTP connection with the OAuth User to Machine Per User auth type, and select your provider from the OAuth Provider drop-down menu. For detailed steps, see Create a connection to the external service.
Services with managed OAuth support
The following integrations use OAuth credentials that Databricks manages and stores securely in the backend. The provider prompts each user to authorize on first use.
Provider | Configuration notes | Supported scopes | Description |
|---|---|---|---|
Google Drive API | None |
| Read access to Google Drive files, including Google Docs and Google Sheets, plus write access to files the app creates or opens. |
Gmail API | None |
| Read and write access to Gmail messages, threads, drafts, and labels. |
Google Calendar API | None |
| Read access to Google Calendar calendars and free/busy information, plus read and write access to events. |
Microsoft 365 API | None | See Microsoft 365 scopes. | Read and write access via Microsoft Graph to SharePoint and OneDrive files, Outlook mail and calendar, and Microsoft Teams chats, channels, and meetings. |
Glean MCP | Requires Host. Base path is configurable (defaults to |
| Access Glean enterprise search, chat, documents, and agent tools. |
GitHub MCP | Uses GitHub App permissions rather than OAuth scopes. The OAuth scope field is not used. | Contents: Read and write; Issues: Read and write; Pull requests: Read and write; Metadata: Read; Members: Read; Projects: Read | Read and write access to GitHub repository contents, issues, and pull requests; read access to organization members and project data. |
Atlassian MCP | None |
| Read and write access to Jira issues and Confluence pages; search Jira and Confluence content. |
Slack MCP | None |
| Search Slack messages, files, channels, canvases, and users; read channel, group, MPIM, and DM history; post messages and write canvases. |
Microsoft 365 scopes
The Microsoft 365 API provider connects through the Microsoft Graph API. The tables below describe the purpose of each Microsoft Graph permission (scope) that Databricks requests, grouped by the Microsoft 365 content the scope supports.
The scopes define the maximum set of actions the connection can attempt on a user's behalf. The content a connection can access still depends on how your organization configures the connection and on the accessing user's own Microsoft 365 permissions. Scopes ending in .All are organization-wide permissions that typically require a Microsoft 365 administrator to consent on behalf of the organization; effective access still depends on the connection's permission model and the accessing user's permissions.
The scopes listed here are representative and can change. The exact set of scopes requested for a connection appears on the Microsoft consent screen when a user connects.
The following table lists the scopes for SharePoint and OneDrive files:
Scope | Purpose |
|---|---|
| Read items in all site collections so a connection can search SharePoint sites. |
| Read and write items in all site collections. |
| Read all files the signed-in user can access. |
The following table lists the scopes for Microsoft Teams:
Scope | Purpose |
|---|---|
| Read the signed-in user's chat messages. |
| Read channel names and descriptions the signed-in user can access. |
| Read messages in channels the signed-in user can access. |
| Send chat messages on behalf of the signed-in user. |
| Send channel messages on behalf of the signed-in user. |
| Read the names and descriptions of teams the signed-in user can access. |
The following table lists the scopes for Outlook mail:
Scope | Purpose |
|---|---|
| Read the signed-in user's mail. |
| Read mail the signed-in user can access, including shared and delegated mailboxes. |
| Read and write the signed-in user's mail. |
The following table lists the scopes for Calendar:
Scope | Purpose |
|---|---|
| Read events in the signed-in user's calendars. |
| Read events in calendars the signed-in user can access, including shared calendars. |
| Read and write events in the signed-in user's calendars. |
The following table lists the scopes for online meetings:
Scope | Purpose |
|---|---|
| Read transcripts of the signed-in user's online meetings. |
| Read AI-generated insights, such as meeting notes, from the signed-in user's online meetings. |
| Read artifacts, such as attendance reports, from the signed-in user's online meetings. |
| Read recordings of the signed-in user's online meetings. |
The following table lists the scopes for identity and authentication:
Scope | Purpose |
|---|---|
| Read the signed-in user's profile to identify them. |
| Read basic profiles of other users to resolve people referenced in content. |
| Maintain the connection with a refresh token so the user doesn't reauthenticate on every request. |
| Sign the user in with OpenID Connect. |
| Read the user's basic profile during sign-in. |
| Read the user's email address during sign-in. |
If needed, allowlist the following redirect URIs that managed OAuth uses:
Cloud | Redirect URI |
|---|---|
AWS |
|
Azure |
|
GCP |
|
For managed OAuth providers with a published MCP server, such as Glean, GitHub, Atlassian, and Slack, Databricks can manage the OAuth credentials when you register the server as an MCP Service. See Register an external MCP server.