How to create Service Principal and access APIs like clusters list without adding to admin group

akshay716
New Contributor III

I have created a Databricks Managed Service Principal and trying to access the APIs like clusters list, job lists pipelines but without adding it to admin group I am getting empty list in response. There are other ways to get clusters by adding policy and giving permission to specific cluster to get the details. Is there a way to create a service principal and access the api (READ only) without giving admin access(admin group)?

Alberto_Umana
Databricks Employee
Databricks Employee

Hi @akshay716,

You can assign specific permissions directly to the service principal without granting it broader admin access

Hi @Alberto_Umana ,

I have selected all the Entitlements for that service principal and in Permissions added all the available roles, still not getting any data without adding it to the Admin group. Am I missing anything?

BlakeWaverly
New Contributor II

You need specific permissions, try assigning cluster and job read access.

@BlakeWaverly  I don't see cluster and job read access, Can you please share where can I find these. though I can assign this service principal to a specific cluster/job as CAN_VIEW but I want to add Read permission on workspace level.

Alberto_Umana
Databricks Employee
Databricks Employee

@akshay716,

Specific Entitlements: You need to assign specific permissions to the service principal for each type of resource you want to access. 

  • Clusters: Grant the CAN_VIEW permission to the service principal for the clusters it needs to access.
  • Jobs: Similar to clusters, assign the CAN_VIEW permission for the jobs the service principal should access.
  • Workflow: Assign the appropriate permission for pipelines access CAN_VIEW

@Alberto_Umana Is it possible to give CAN_VIEW permission on the workspace level instead of specific resource?

Alberto_Umana
Databricks Employee
Databricks Employee

Only admin access through account console can be given not read only unfortunately.

View solution in original post