topic Re: How to create Service Principal and access APIs like clusters list without adding to admin group in Data Engineering

How to create Service Principal and access APIs like clusters list without adding to admin group

akshay716 — Wed, 19 Feb 2025 16:33:32 GMT

I have created a Databricks Managed Service Principal and trying to access the APIs like clusters list, job lists pipelines but without adding it to admin group I am getting empty list in response. There are other ways to get clusters by adding policy and giving permission to specific cluster to get the details. Is there a way to create a service principal and access the api (READ only) without giving admin access(admin group)?

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

Alberto_Umana — Wed, 19 Feb 2025 20:23:29 GMT

Hi @akshay716,

You can assign specific permissions directly to the service principal without granting it broader admin access

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

akshay716 — Thu, 20 Feb 2025 05:33:45 GMT

Hi @Alberto_Umana ,

I have selected all the Entitlements for that service principal and in Permissions added all the available roles, still not getting any data without adding it to the Admin group. Am I missing anything?

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

BlakeWaverly — Thu, 20 Feb 2025 05:48:33 GMT

You need specific permissions, try assigning cluster and job read access.

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

akshay716 — Thu, 20 Feb 2025 06:00:37 GMT

@BlakeWaverly I don't see cluster and job read access, Can you please share where can I find these. though I can assign this service principal to a specific cluster/job as CAN_VIEW but I want to add Read permission on workspace level.

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

Alberto_Umana — Thu, 20 Feb 2025 12:46:18 GMT

@akshay716,

Specific Entitlements: You need to assign specific permissions to the service principal for each type of resource you want to access.

Clusters: Grant the CAN_VIEW permission to the service principal for the clusters it needs to access.
Jobs: Similar to clusters, assign the CAN_VIEW permission for the jobs the service principal should access.
Workflow: Assign the appropriate permission for pipelines access CAN_VIEW

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

akshay716 — Thu, 20 Feb 2025 13:04:46 GMT

@Alberto_Umana Is it possible to give CAN_VIEW permission on the workspace level instead of specific resource?

Re: How to create Service Principal and access APIs like clusters list without adding to admin group

Alberto_Umana — Thu, 20 Feb 2025 13:10:07 GMT

Only admin access through account console can be given not read only unfortunately.