## Grant query text access for Databricks

URL: https://docs.atlan.com/apps/connectors/data-warehouses/databricks/how-tos/grant-query-text-access

> Add Atlan's service principal to the databricks_pii_access group to restore query text after Databricks masks it by default.

# Grant query text access for Databricks

Databricks began masking the SQL text of queries in query history by default from Aug 26, 2026, which pauses [usage and popularity, query detail in lineage, and SQL Intelligence](https://docs.atlan.com/llms/connectors/databricks/databricks-sql-masking-change/llms.txt) for your Databricks assets in Atlan. Adding Atlan's service principal to one account-level group restores them. Your lineage graph is unaffected throughout.

:::info Who can do this?
Only a **Databricks account admin** can create the group and add members - it's an account-level change, not a workspace one. If that isn't you, forward this page to whoever manages your Databricks account, along with Atlan's service principal name from your connection settings.
:::

## Prerequisites

Before you begin, have **Atlan's service principal name** ready. Your Atlan administrator can copy it from the Databricks connection's credentials in Atlan.

## Add service principal to group

In the Databricks [Account Console](https://docs.databricks.com/aws/en/admin/users-groups/manage-groups), go to **User management > Groups**:

1. Look for a group named exactly `databricks_pii_access` (case-sensitive). If it doesn't exist, click **Add group** and create it with that name.
2. Open the group, click **Add members**, and add the service principal your Atlan connection uses. Your Atlan admin can copy its exact name from the Databricks connection's credentials in Atlan.

:::warning Create the group from the Account Console
Create `databricks_pii_access` from the **Account Console**, not from workspace admin settings. A workspace admin who creates it receives Manage permission on the group and may change who sees unmasked query text. Keeping it account-level keeps that control where it belongs.
:::

A few things worth knowing:

- One grant covers every workspace in the account - the group is account-level.
- If you have multiple Atlan connections or Databricks accounts, add each service principal, once per account.
- If your groups sync from Okta or Microsoft Entra ID, create the group in your identity provider and sync it at account level instead.

## Confirm it worked

Membership takes a few minutes to apply. After that, open any Databricks asset in Atlan and check the **Usage** or **Queries** tab on the connection's next scheduled run - if query detail and usage are updating again, you're done.

To confirm directly in Databricks, or if query text still doesn't come back, run the check in [How do I check where my connection stands?](https://docs.atlan.com/llms/connectors/databricks/databricks-sql-masking-change/llms.txt)

## See also

- [Query text access in Databricks](https://docs.atlan.com/llms/connectors/databricks/databricks-sql-masking-change/llms.txt): What the masking change affects, what it doesn't, and the customer-managed keys case.
- [Extract lineage and usage from Databricks](https://docs.atlan.com/llms/connectors/databricks/extract-lineage-and-usage-from-databricks/llms.txt): Configure lineage and usage extraction for your Databricks connection.

---