Skip to main content

Grant query text access for Databricks

TL;DR

Add Atlan's service principal to the databricks_pii_access group to restore query text after Databricks masks it by default.

Connect

Databricks began masking the SQL text of queries in query history by default from Aug 26, 2026, which pauses usage and popularity, query detail in lineage, and SQL Intelligence for your Databricks assets in Atlan. Adding Atlan's service principal to one account-level group restores them. Your lineage graph is unaffected throughout.

Who can do this?

Only a Databricks account admin can create the group and add members - it's an account-level change, not a workspace one. If that isn't you, forward this page to whoever manages your Databricks account, along with Atlan's service principal name from your connection settings.

Prerequisites​

Before you begin, have Atlan's service principal name ready. Your Atlan administrator can copy it from the Databricks connection's credentials in Atlan.

Add service principal to group​

In the Databricks Account Console, go to User management > Groups:

  1. Look for a group named exactly databricks_pii_access (case-sensitive). If it doesn't exist, click Add group and create it with that name.
  2. Open the group, click Add members, and add the service principal your Atlan connection uses. Your Atlan admin can copy its exact name from the Databricks connection's credentials in Atlan.
Create the group from the Account Console

Create databricks_pii_access from the Account Console, not from workspace admin settings. A workspace admin who creates it receives Manage permission on the group and may change who sees unmasked query text. Keeping it account-level keeps that control where it belongs.

A few things worth knowing:

  • One grant covers every workspace in the account - the group is account-level.
  • If you have multiple Atlan connections or Databricks accounts, add each service principal, once per account.
  • If your groups sync from Okta or Microsoft Entra ID, create the group in your identity provider and sync it at account level instead.

Confirm it worked​

Membership takes a few minutes to apply. After that, open any Databricks asset in Atlan and check the Usage or Queries tab on the connection's next scheduled run - if query detail and usage are updating again, you're done.

To confirm directly in Databricks, or if query text still doesn't come back, run the check in How do I check where my connection stands?

See also​