Skip to main content
Last updated on

SSO to Databricks with Okta

Preview

This feature is in Public Preview.

This page shows how to configure Okta as the identity provider for single sign-on (SSO) in your Databricks account. Okta supports both OpenID Connect (OIDC) and SAML 2.0. To sync users and groups from Okta, see Sync users and groups from your identity provider using SCIM.

The following demos walk you through configuring SSO with Okta:

Enable Okta single sign-on​

Choose your identity protocol:

  1. As an account admin, log in to the account console and click Security.

  2. Click the Identity provider setup tab.

  3. In the Authentication section, configure single sign-on to open the SSO configuration dialog.

  4. On the Add details step, under Identity protocol, select OpenID Connect.

  5. Make note of the Databricks redirect URL value.

  6. In a new browser tab, log into Okta as an administrator.

  7. In the home page, click Applications > Applications.

  8. Click Create App Integration.

  9. Select OIDC - OpenID Connect and Web Application and click Next.

  10. Name your app integration.

  11. In Sign-in redirect URIs, enter the Databricks redirect URL you noted earlier. You can choose to configure the other settings or you can leave them to their default values.

  12. In Assignments, select Allow everyone in your organization to access. This ensures all users in your organization can access the Databricks account.

  13. Click Save.

  14. In the General tab, copy the client ID and client secret generated by Okta for the application.

    • Client ID is the unique identifier for the Databricks application you created in your identity provider.
    • Client secret is a secret or password generated for the Databricks application that you created. It is used to authorize Databricks with your identity provider.

  15. Click the Sign On tab, in OpenID Connect ID Token copy the Okta URL in the issuer field.

    If the issuer field says Dynamic, click Edit and select Okta URL in the dropdown menu.

    note

    This URL points to Okta’s OpenID Configuration Document, which is located at {issuer-url}/.well-known/openid-configuration. You can specify query parameters by appending them to the issuer URL, for example {issuer-url}?appid=123.

  16. Return to the SSO configuration dialog in the Databricks account console and enter the values you copied from the identity provider application in the Client ID, Client secret, and Okta domain fields.

  17. Optionally, set a User attribute claim if you want to use a claim other than email as users' Databricks usernames. See your identity provider's documentation for specific information on claim values.

    Single sign-on tab when all values have been entered

  18. On the Enable SSO step, click Enable SSO. Databricks saves the configuration in a disabled state and runs a connection test. You are redirected to complete a sign-in with Okta. If the test succeeds, SSO is enabled automatically. If the test fails, Databricks reports that it couldn't validate the configuration. Review the values you entered and try again.

  19. After SSO is enabled, use the next-steps card to choose how to provision users from Okta:

    • To automatically enable users from your identity provider, click Configure for Automatic Identity Management (AIM). See Automatic identity management.
    • To create user accounts the first time a user signs in, enable just-in-time (JIT) provisioning using the Create new identities during first-time signup toggle. See Automatically provision users (JIT).

For detailed post-setup testing guidance, including workspace login testing, see Test your SSO configuration.

Add users to Databricks​

After you configure SSO, add users to your account. Databricks recommends syncing users from your identity provider using automatic identity management, which syncs users and groups automatically from your identity provider to your Databricks account. See Configure Microsoft Entra ID for automatic identity management. Alternatively, if your identity provider does not support automatic identity management, you can configure SCIM provisioning. See Sync users and groups from your identity provider using SCIM.

Just-in-time (JIT) provisioning, which automatically adds users to Databricks when they first log in using SSO, is on by default for accounts created after February 2, 2026. See Automatically provision users (JIT).

On this page