Configure an OAuth service account for Google Drive ingestion

An OAuth service account authenticates Google Drive ingestion into Azure Databricks as a Google service account rather than an individual user.

Tip

If you only need to ingest files that a single person can access, OAuth U2M: Databricks-managed requires no Google Cloud setup.

Prerequisites

• A Azure Databricks workspace with Unity Catalog enabled.
• The CREATE CONNECTION privilege on the metastore.
• A Google Cloud project with the Google Drive API enabled. To enable it, go to APIs & Services > Library in the Google Cloud console, search for "Google Drive API", then select Enable.

Step 1: Create a service account and key

1. On the Google Cloud console home screen, go to IAM & Admin > Service Accounts.

2. Select Create service account.

3. Enter a service account name (for example, databricks-google-drive), then select Create and continue.

4. Skip the optional role and user access steps, then select Done.

5. On the Service accounts page, select the service account you created.

6. On the Keys tab, select Add key > Create new key.

7. For Key type, select JSON, then select Create.

   This downloads the service account key in JSON format. Store it securely: it grants access to the data the service account can read, and Google doesn't let you download it again.

8. Record the service account's email address, shown on the Details tab. You use it to share Google Drive content in the next step.

Step 2: Grant the service account access to your Google Drive content

In Google Drive, share each file, folder, or shared drive you want to ingest with the service account's email address, granting at least Viewer access. The connector can ingest only content shared with the service account.

Note

The connector requests read-only scopes and cannot modify or delete data in Google Drive.

Next steps

1. Create a connection to store the authentication details that you've obtained.
2. Create an ingestion pipeline.