Databricks
Connect Databricks to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Databricks to collect data export evidence with automated compliance tests, switched on per workspace.
| Category | Data Export |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Databricks's guide | docs.databricks.com |
Connect with an API token
-
In Databricks:
- As a workspace admin, add a dedicated service principal to the workspace: click your username in the top bar and select Settings, click the Identity and access tab, next to Service principals click Manage, click Add service principal, select the service principal, select its entitlements and click Add. Do not add it to the admins group.
- Create a personal access token on behalf of the service principal. Databricks documents no workspace-UI button for this; a workspace admin runs the Databricks CLI:
databricks token-management create-obo-token <application-id> --lifetime-seconds <lifetime-seconds> -p <profile-name>, and copies the token it returns. - Alternative (user token instead of a service principal, not recommended): go to Settings › Developer › Access tokens › Manage › Generate new token, copy the displayed token to a secure location, then click Done.
Where to find the other values:
- Instance URL: The workspace URL you log in to, from your browser's address bar, e.g.
https://cust-success.cloud.databricks.com/.
Databricks shows the secret only once, so copy it before you leave the page.
Databricks's public documentation does not cover every step.
Service principal tokens are created through the CLI/API (token-management create-obo-token), not a UI screen, which is why this is partial. The service principal must already exist at the account level (or be created from the Add service principal dialog). Personal access tokens must be enabled for the workspace. Databricks recommends OAuth over PATs for service principals. Copy the token at creation; it is not shown again.
Source: docs.databricks.com, docs.databricks.com, docs.databricks.com, docs.databricks.com, checked 2026-10-07.
The permissions Safeguard needs:
service principal (not a workspace admin). -
On Compliance › Connectors, open Databricks, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. For example: https://acme.cloud.databricks.com Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Databricks and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Data Export connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks