Access storage using a service principal & Microsoft Entra ID(Azure Active Directory)

Registering an application with Microsoft Entra ID creates a service principal you can use to provide access to Azure storage accounts.

You can then configure access to these service principals using credentials stored with secrets. Databricks recommends using Microsoft Entra ID service principals scoped to clusters or SQL warehouses to configure data access. See Connect to Azure Data Lake Storage Gen2 and Blob Storage and Enable data access configuration.

Register a Microsoft Entra ID application

Registering a Microsoft Entra ID (formerly Azure Active Directory) application and assigning appropriate permissions will create a service principal that can access Azure Data Lake Storage Gen2 or Blob Storage resources.

To register a Microsoft Entra ID application, you must have the Application Administrator role or the Application.ReadWrite.All permission in Microsoft Entra ID.

  1. In the Azure portal, go to the Microsoft Entra ID service.

  2. Under Manage, click App Registrations.

  3. Click + New registration. Enter a name for the application and click Register.

  4. Click Certificates & Secrets.

  5. Click + New client secret.

  6. Add a description for the secret and click Add.

  7. Copy and save the value for the new secret.

  8. In the application registration overview, copy and save the Application (client) ID and Directory (tenant) ID.

Assign roles

You control access to storage resources by assigning roles to a Microsoft Entra ID application registration associated with the storage account. You might need to assign other roles depending on specific requirements.

To assign roles on a storage account you must have the Owner or User Access Administrator Azure RBAC role on the storage account.

  1. In the Azure portal, go to the Storage accounts service.

  2. Select an Azure storage account to use with this application registration.

  3. Click Access Control (IAM).

  4. Click + Add and select Add role assignment from the dropdown menu.

  5. Set the Select field to the Microsoft Entra ID application name and set Role to Storage Blob Data Contributor.

  6. Click Save.