Databricks Apps - Deployment process - Need help !!

Sanjeeb2024 — Sat, 05 Sep 2026 05:38:57 GMT

Hi all,

Do we have any guidelines or a CI/CD approach for deploying a Databricks app from one environment (e.g., DEV) to PROD?We are currently facing the following challenge:We created a Databricks app in the DEV environment through the UI. At runtime, the app creates a service principal, to which we granted the required permissions to access Databricks tables. After deploying the code, everything works as expected in DEV.How can we fully automate the deployment process from DEV to PROD? In particular, how can we automate assigning the required permissions to the service principal that is created at runtime in the target environment?Any guidance or examples would be appreciated.

Regards

Re: Databricks Apps - Deployment process - Need help !!

balajij8 — Sat, 05 Sep 2026 07:16:38 GMT

@Sanjeeb2024 DABs is the right approach for managing and promoting Databricks Apps across environments (DEV to PROD). When you deploy an app via DABs, Databricks automatically provisions a dedicated service principal for that app instance. This service principal persists across all subsequent code updates and is deleted only when the app itself is deleted. Each target environment maintains its own isolated app instance with its own dedicated service principal, keeping DEV and PROD credentials and identities completely decoupled. More details here

To automate access in the target environment, you can declare grants resource directly in the bundle YAML rather than configuring permissions manually in Unity Catalog. DABs exposes the runtime service principal using bundle substitution via ${resources.apps.<app-name>.service_principal_client_id}, allowing you to bind permissions directly to the generated identity during the deploy phase

bundle: name: files_db_app variables: catalog: default: dev_catalog targets: dev: default: true workspace: host: https://dev variables: catalog: dev_catalog prod: workspace: host: https://prod variables: catalog: prod_catalog resources: apps: file_app: name: 'file-app-${bundle.target}' grants: app_table_access: principal: '${resources.apps.file_app.service_principal_client_id}' privileges: [SELECT, MODIFY] catalog_name: ${var.catalog}

By parameterizing the catalogs and schemas using bundle variables like ${var.catalog} and ${bundle.target}, permissions are resolved dynamically per stage. Running databricks bundle deploy -t prod in the CI/CD pipeline deploys the updated application code, provisions or updates the PROD-specific service principal and applies all required table privileges in a single, declarative run. More details here

topic Databricks Apps - Deployment process - Need help !! in Data Engineering

Databricks Apps - Deployment process - Need help !!

Re: Databricks Apps - Deployment process - Need help !!