From bb38a855ac757fb3443ab1097f3127bfc26513c0 Mon Sep 17 00:00:00 2001 From: Charles Yu Date: Fri, 14 Aug 2026 20:54:09 +0000 Subject: [PATCH 1/3] docs(databricks): require Databricks SQL Access and Workspace Access entitlements in Permissions section --- .../jobs_monitoring/databricks/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md index d17fcd9aa4b..870c4e4091f 100644 --- a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md +++ b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md @@ -462,6 +462,13 @@ DD_LOGS_CONFIG_PROCESSING_RULES=[{\"type\": \"exclude_at_match\",\"name\": \"dro ### Permissions Grant {{< ui >}}Workspace Admin{{< /ui >}} privileges to the user or service principal that connects to your Databricks workspace. This allows Datadog to manage init script installations and updates automatically, reducing the risk of misconfiguration. +
Regardless of whether you grant Workspace Admin privileges or the granular permissions below, the user or service principal must have the following workspace entitlements enabled: + +
+ If you need more granular control, grant these minimal permissions to the following [workspace level objects][19] to still be able to monitor all jobs, clusters, and queries within a workspace: | Object | Permission | From bdbbd4f0914e636da370ebfc6105312379c8ab43 Mon Sep 17 00:00:00 2001 From: Charles Yu Date: Fri, 14 Aug 2026 20:58:06 +0000 Subject: [PATCH 2/3] docs(databricks): restructure Permissions section into logical subsections --- .../jobs_monitoring/databricks/_index.md | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md index 870c4e4091f..1d9a501663b 100644 --- a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md +++ b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md @@ -460,16 +460,18 @@ DD_LOGS_CONFIG_PROCESSING_RULES=[{\"type\": \"exclude_at_match\",\"name\": \"dro ``` ### Permissions -Grant {{< ui >}}Workspace Admin{{< /ui >}} privileges to the user or service principal that connects to your Databricks workspace. This allows Datadog to manage init script installations and updates automatically, reducing the risk of misconfiguration. +The user or service principal that connects to your Databricks workspace must have the following workspace entitlements enabled, in addition to the permissions described below: -
Regardless of whether you grant Workspace Admin privileges or the granular permissions below, the user or service principal must have the following workspace entitlements enabled: -
    -
  • {{< ui >}}Databricks SQL access{{< /ui >}}
    • -
  • {{< ui >}}Workspace access{{< /ui >}}
    • -
-
+- {{< ui >}}Databricks SQL access{{< /ui >}} +- {{< ui >}}Workspace access{{< /ui >}} + +#### Workspace Admin privileges -If you need more granular control, grant these minimal permissions to the following [workspace level objects][19] to still be able to monitor all jobs, clusters, and queries within a workspace: +Grant {{< ui >}}Workspace Admin{{< /ui >}} privileges to the user or service principal. This allows Datadog to manage init script installations and updates automatically, reducing the risk of misconfiguration. + +#### Granular permissions + +If you need more granular control instead of Workspace Admin privileges, grant these minimal permissions to the following [workspace level objects][19] to still be able to monitor all jobs, clusters, and queries within a workspace: | Object | Permission | |--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -479,6 +481,8 @@ If you need more granular control, grant these minimal permissions to the follow | Query | [CAN VIEW][23] | SQL warehouse | [CAN MONITOR][24] +#### Cost data permissions + Additionally, for Datadog to access your Databricks cost data in Data Observability: Jobs Monitoring or [Cloud Cost Management][26], the user or service principal used to query [system tables][27] must have the following permissions: - `CAN USE` permission on the SQL Warehouse. - Read access to the [system tables][27] within Unity Catalog. In Databricks, open the {{< ui >}}SQL Editor{{< /ui >}} and run the following commands, using the service principal's client ID (not its display name): From fa59b43f57b605675d74a01c20276d1d56938184 Mon Sep 17 00:00:00 2001 From: Charles Yu Date: Fri, 14 Aug 2026 21:00:07 +0000 Subject: [PATCH 3/3] docs(databricks): merge Workspace Admin and Granular permissions as alternatives --- .../jobs_monitoring/databricks/_index.md | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md index 1d9a501663b..dbd0acfc471 100644 --- a/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md +++ b/hugo/content/en/data_observability/jobs_monitoring/databricks/_index.md @@ -465,21 +465,20 @@ The user or service principal that connects to your Databricks workspace must ha - {{< ui >}}Databricks SQL access{{< /ui >}} - {{< ui >}}Workspace access{{< /ui >}} -#### Workspace Admin privileges +#### Workspace permissions -Grant {{< ui >}}Workspace Admin{{< /ui >}} privileges to the user or service principal. This allows Datadog to manage init script installations and updates automatically, reducing the risk of misconfiguration. +Choose one of the following approaches for the user or service principal: -#### Granular permissions +- **Workspace Admin privileges** (recommended): Grant {{< ui >}}Workspace Admin{{< /ui >}} privileges. This allows Datadog to manage init script installations and updates automatically, reducing the risk of misconfiguration. +- **Granular permissions**: If you need more granular control, grant these minimal permissions to the following [workspace level objects][19] to still be able to monitor all jobs, clusters, and queries within a workspace: -If you need more granular control instead of Workspace Admin privileges, grant these minimal permissions to the following [workspace level objects][19] to still be able to monitor all jobs, clusters, and queries within a workspace: - -| Object | Permission | -|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Job | [CAN VIEW][20] -| Compute | [CAN ATTACH TO][21] -| Lakeflow Declarative Pipelines | [CAN VIEW][22] -| Query | [CAN VIEW][23] -| SQL warehouse | [CAN MONITOR][24] + | Object | Permission | + |--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| + | Job | [CAN VIEW][20] + | Compute | [CAN ATTACH TO][21] + | Lakeflow Declarative Pipelines | [CAN VIEW][22] + | Query | [CAN VIEW][23] + | SQL warehouse | [CAN MONITOR][24] #### Cost data permissions