> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Databricks

> Connect Databricks to Iru Compliance with a workspace URL and a read-only access token to collect user and group inventory, workspace permissions, cluster security settings, and secret scope access controls.

### About Databricks

Iru reads **users and groups**, **workspace permissions**, **cluster configurations**, **secret scopes**, and **Unity Catalog permissions** (where Unity Catalog is in use) from the Databricks REST API. Authentication uses a **Bearer** token: either a **personal access token** created under **User Settings** → **Developer** → **Access tokens**, or a **service principal** token. Requests target your workspace host, so Iru stores the **workspace URL** first, then the token.

### How It Works

```http theme={null}
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Databricks is **per-workspace**: each workspace has its own host (for example `https://dbc-1234abcd-5e6f.cloud.databricks.com` on AWS, or `https://adb-1234567890.12.azuredatabricks.net` on Azure) and its own tokens. A token is valid only against the workspace that issued it, so connect one source per workspace you need evidence from. Iru reads **secret scope names and their access control lists**. It does not read **secret values**.

| Detail             | Value                 |
| ------------------ | --------------------- |
| **Category**       | Analytics             |
| **Authentication** | Bearer (access token) |

Official references: [REST API reference](https://docs.databricks.com/api/workspace/introduction), [Authentication](https://docs.databricks.com/aws/en/dev-tools/auth/).

### Prerequisites

* Your **workspace URL**, copied from the browser when signed in to the workspace.
* **Workspace admin** access. Token creation can be restricted by workspace settings, and a non-admin token returns only the permissions and clusters that account can already see.
* Personal access tokens **enabled** for the workspace. If admins have disabled them, use a **service principal** instead.
* Decide what is in scope. Databricks lets you exclude workspaces or secret scopes, and excluded objects produce no evidence.

### Connect Databricks to Iru

<Tabs>
  <Tab title="Databricks">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to the workspace">
        Sign in to the Databricks workspace you want Iru to read, using an account with the **admin** role.
      </Step>

      <Step title="Open Settings">
        Select your **username** in the top bar, then **Settings**.
      </Step>

      <Step title="Open Access tokens">
        Go to **Developer**, then select **Manage** beside **Access tokens**.
      </Step>

      <Step title="Generate a new token">
        Select **Generate new token**.
      </Step>

      <Step title="Name and set lifetime">
        Enter a **Comment** such as **Iru Compliance**, and set a **Lifetime** your team can track. Collection stops when a token expires. Leaving the lifetime blank creates a non-expiring token, which some security policies disallow.
      </Step>

      <Step title="Copy the token and workspace URL">
        Select **Generate**, then copy the token value **once** while Databricks displays it. Copy the **workspace URL** from your browser's address bar (the scheme and host only, with no trailing path).
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Databricks**](#databricks) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/tI0HDLDwHj8r9Ile/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=tI0HDLDwHj8r9Ile&q=85&s=87dcef15fc17d2fb9a6e53f454e41710" alt="Left navigation: Compliance expanded, Sources selected" width="410" height="1024" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Databricks">
        Find **Databricks** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter the workspace URL">
        Enter the **workspace URL**. Confirm the preview URL if the wizard shows one.
      </Step>

      <Step title="Paste the Bearer token">
        Paste the token into the **Bearer** field.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Credentials**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Databricks** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Authentication fails">
    Confirm the token was created in the **same workspace** as the URL you entered. Tokens are not portable between workspaces.
  </Accordion>

  <Accordion title="Token creation is unavailable in Settings">
    A workspace admin has disabled personal access tokens. Either re-enable them or authenticate with a **service principal**.
  </Accordion>

  <Accordion title="Users and clusters appear but permissions look incomplete">
    The token belongs to a non-admin account and is returning only what that account can see. Recreate it from a workspace admin.
  </Accordion>

  <Accordion title="No Unity Catalog data">
    This is expected if the workspace does not use Unity Catalog. Iru collects Unity Catalog data only when it is present.
  </Accordion>

  <Accordion title="Collection worked and then stopped">
    The token's **Lifetime** has elapsed. Generate a new one and reconnect.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>