Permissions for Databricks AI/BI dashboards
Databricks AI/BI dashboard support is in private preview and is enabled per tenant. The Import AI/BI Dashboards and Enable Dashboard Lineage options stay hidden in the workflow setup until the feature is enabled for your tenant. To request access, raise a support request.
This reference covers the privileges the Atlan service account needs to crawl Databricks AI/BI dashboards and extract their lineage and usage metrics, what each privilege enables, and how to grant it.
For standard Databricks connector permissions, see Set up Databricks.
Dashboards differ from other Databricks assets: their metadata comes from the Lakeview REST API and is governed by workspace access controls, while their lineage and usage come from Unity Catalog system tables. You need grants on both surfaces.
Dashboard metadata privileges
These access levels are required for Atlan to list dashboards and read their metadata from the Lakeview API.
| Access level | Scope | What it enables |
|---|---|---|
CAN VIEW | Dashboard, workspace folder, or workspace | Lists the dashboard and reads its name, path, warehouse, and lifecycle state. Without this, the dashboard is invisible to the crawler. |
CAN MANAGE | Dashboard | Lets Atlan read the dashboard's permissions to populate its owners. Optional—see Owner privileges. |
Granting at workspace level compared to per dashboard
Granting access per dashboard gives precise control but requires ongoing maintenance as new dashboards are created. Granting CAN VIEW at the workspace level covers all current and future dashboards without manual re-grants:
- Per dashboard or folder: more precise, higher operational overhead
- Workspace level: simpler, broader—recommended for full coverage
The Lakeview list API filters results by access control. Dashboards the service account can't view are absent from Atlan—the workflow succeeds without reporting them as errors. If dashboards are missing after crawling, see Why are some dashboards missing after crawling?
Owner privileges
Atlan sets a dashboard's owners from the users granted CAN MANAGE on it. Group and service principal grants are skipped—an owner is a person.
Reading these grants requires CAN MANAGE on the dashboard. If the service account doesn't have it, Atlan catalogs the dashboard without owners rather than failing the crawl.
Lineage privileges
These privileges are required for Atlan to build lineage from dashboards to the Unity Catalog assets they read.
| Privilege | Scope | What it enables |
|---|---|---|
SELECT | system.access.table_lineage | Lets Atlan read table-to-dashboard and metric-view-to-dashboard lineage edges. |
SELECT | system.access.column_lineage | Lets Atlan read column-to-dashboard lineage edges. |
CAN USE | SQL warehouse | Lets Atlan run the lineage queries against the system tables. |
Grant SELECT on the system tables as follows:
GRANT SELECT ON TABLE system.access.table_lineage TO `<atlan_user_or_role>`;
GRANT SELECT ON TABLE system.access.column_lineage TO `<atlan_user_or_role>`;
If you can't grant SELECT on the system tables directly, you can use cloned views instead. See Create cloned views of system tables.
Usage privileges
Required only if you want usage and popularity metrics on your dashboards.
| Privilege | Scope | What it enables |
|---|---|---|
SELECT | system.query.history | Lets Atlan aggregate query counts, distinct users, and last-read timestamps per dashboard. |
GRANT SELECT ON TABLE system.query.history TO `<atlan_user_or_role>`;
Atlan aggregates only query counts, distinct user counts, and timestamps. It doesn't read query text for dashboard usage, so redacted query history doesn't affect these metrics.
See also
- Crawl Databricks AI/BI dashboards: Discover and catalog AI/BI dashboards from your Databricks workspace.
- Extract Databricks dashboard lineage: Build lineage from dashboards to the tables and columns they read.
- Set up Databricks: Standard connector permissions and setup.