## Permissions for Databricks AI/BI dashboards

URL: https://docs.atlan.com/apps/connectors/data-warehouses/databricks/references/permissions-for-databricks-ai-bi-dashboards

> Full reference of the privileges required to crawl Databricks AI/BI dashboards and extract their lineage and usage metrics, including what each privilege enables and how to grant it.

:::info Private Preview
Databricks AI/BI dashboard support is in [private preview](https://docs.atlan.com/llms/platform/get-started/product-release-stages/llms.txt) and is enabled per tenant. The **Import AI/BI Dashboards** and **Enable Dashboard Lineage** options stay hidden in the workflow setup until the feature is enabled for your tenant. To request access, [raise a support request](https://docs.atlan.com/support/submit-request).
:::

This reference covers the privileges the Atlan service account needs to crawl Databricks AI/BI dashboards and extract their lineage and usage metrics, what each privilege enables, and how to grant it.

For standard Databricks connector permissions, see [Set up Databricks](https://docs.atlan.com/llms/connectors/databricks/set-up-databricks/llms.txt).

Dashboards differ from other Databricks assets: their metadata comes from the Lakeview REST API and is governed by workspace access controls, while their lineage and usage come from Unity Catalog system tables. You need grants on both surfaces.

## Dashboard metadata privileges

These access levels are required for Atlan to list dashboards and read their metadata from the Lakeview API.

| Access level | Scope | What it enables |
|---|---|---|
| `CAN VIEW` | Dashboard, workspace folder, or workspace | Lists the dashboard and reads its name, path, warehouse, and lifecycle state. Without this, the dashboard is invisible to the crawler. |
| `CAN MANAGE` | Dashboard | Lets Atlan read the dashboard's permissions to populate its owners. Optional—see [Owner privileges](#owner-privileges). |

**Granting at workspace level compared to per dashboard**

Granting access per dashboard gives precise control but requires ongoing maintenance as new dashboards are created. Granting `CAN VIEW` at the workspace level covers all current and future dashboards without manual re-grants:

- **Per dashboard or folder**: more precise, higher operational overhead
- **Workspace level**: simpler, broader—recommended for full coverage

The Lakeview list API filters results by access control. Dashboards the service account can't view are absent from Atlan—the workflow succeeds without reporting them as errors. If dashboards are missing after crawling, see [Why are some dashboards missing after crawling?](https://docs.atlan.com/llms/connectors/databricks/troubleshooting-databricks-connectivity/llms.txt)

## Owner privileges

Atlan sets a dashboard's owners from the users granted `CAN MANAGE` on it. Group and service principal grants are skipped—an owner is a person.

Reading these grants requires `CAN MANAGE` on the dashboard. If the service account doesn't have it, Atlan catalogs the dashboard without owners rather than failing the crawl.

## Lineage privileges

These privileges are required for Atlan to build lineage from dashboards to the Unity Catalog assets they read.

| Privilege | Scope | What it enables |
|---|---|---|
| `SELECT` | `system.access.table_lineage` | Lets Atlan read table-to-dashboard and metric-view-to-dashboard lineage edges. |
| `SELECT` | `system.access.column_lineage` | Lets Atlan read column-to-dashboard lineage edges. |
| `CAN USE` | SQL warehouse | Lets Atlan run the lineage queries against the system tables. |

Grant `SELECT` on the system tables as follows:

```sql
GRANT SELECT ON TABLE system.access.table_lineage TO `<atlan_user_or_role>`;
GRANT SELECT ON TABLE system.access.column_lineage TO `<atlan_user_or_role>`;
```

If you can't grant `SELECT` on the system tables directly, you can use cloned views instead. See [Create cloned views of system tables](https://docs.atlan.com/llms/connectors/databricks/set-up-databricks/llms.txt).

## Usage privileges

Required only if you want usage and popularity metrics on your dashboards.

| Privilege | Scope | What it enables |
|---|---|---|
| `SELECT` | `system.query.history` | Lets Atlan aggregate query counts, distinct users, and last-read timestamps per dashboard. |

```sql
GRANT SELECT ON TABLE system.query.history TO `<atlan_user_or_role>`;
```

Atlan aggregates only query counts, distinct user counts, and timestamps. It doesn't read query text for dashboard usage, so redacted query history doesn't affect these metrics.

## See also

- [Crawl Databricks AI/BI dashboards](https://docs.atlan.com/llms/connectors/databricks/crawl-databricks-ai-bi-dashboards/llms.txt): Discover and catalog AI/BI dashboards from your Databricks workspace.
- [Extract Databricks dashboard lineage](https://docs.atlan.com/llms/connectors/databricks/extract-databricks-dashboard-lineage/llms.txt): Build lineage from dashboards to the tables and columns they read.
- [Set up Databricks](https://docs.atlan.com/llms/connectors/databricks/set-up-databricks/llms.txt): Standard connector permissions and setup.

---