databricksazure-databricksdatabricks-sql

how to restrict Azure AD SPN permission with Databricks?

Hello I m using Data bricks, and working with https://docs.databricks.com/api/workspace/statementexecution I m using SQL Api statement with help of Azure ADAP SPN token. I m able to run all queries successfully.

https://medium.com/@masterkeshav/consuming-databricks-sql-on-azure-service-user-principals-with-row-column-level-security-5618377bd0ec

I want to restrict this SPN to use only to read Data. If I Use any delete query or any query apart of read operation I don't want to allow to that SPN. I also dont want to allow that SPN to Do any DML operation or delete job or cluster or Wearhouse kind job. I just want that SPN to allow to read data. Any one have done this

Solution

  • You can restrict the service principal for SQL query execution at the schema level and the table level.

    To grant such permission follow below steps:

    Go To > Catalog > Select schema or table > Permissions > Grant

    enter image description here

    After clicking on "Grant," you will see the window below.

    enter image description here

    Here, search for the service principal you previously added and grant only select permission.

    enter image description here

    This restricts the service principal to read-only access for an object.