External services with managed OAuth

Azure Databricks offers managed OAuth flows for select API tool providers. You don't need to register your own OAuth app or manage credentials. Azure Databricks recommends Managed OAuth for development and testing. If production use cases require generating custom OAuth credentials, see the providers' documentation for more information.

Requirements

Create a Unity Catalog HTTP connection with the OAuth User to Machine Per User auth type, and select your provider from the OAuth Provider drop-down menu. For detailed steps, see Create a connection to the external service.

Services with managed OAuth support

The following integrations use OAuth credentials that Azure Databricks manages and stores securely in the backend. The provider prompts each user to authorize on first use.

Provider	Configuration notes	Supported scopes	Description
Google Drive API	None	https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/documents.readonly https://www.googleapis.com/auth/spreadsheets.readonly https://www.googleapis.com/auth/drive.file offline_access	Read access to Google Drive files, including Google Docs and Google Sheets, plus write access to files the app creates or opens.
Gmail API	None	https://www.googleapis.com/auth/gmail.modify offline_access	Read and write access to Gmail messages, threads, drafts, and labels.
Google Calendar API	None	https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/calendar.events offline_access	Read access to Google Calendar calendars and free/busy information, plus read and write access to events.
Microsoft 365 API	None	See Microsoft 365 scopes.	Read and write access via Microsoft Graph to SharePoint and OneDrive files, Outlook mail and calendar, and Microsoft Teams chats, channels, and meetings.

Microsoft 365 scopes

The Microsoft 365 API provider connects through the Microsoft Graph API. The tables below describe the purpose of each Microsoft Graph permission (scope) that Azure Databricks requests, grouped by the Microsoft 365 content the scope supports.

The scopes define the maximum set of actions the connection can attempt on a user's behalf. The content a connection can access still depends on how your organization configures the connection and on the accessing user's own Microsoft 365 permissions. Scopes ending in .All are organization-wide permissions that typically require a Microsoft 365 administrator to consent on behalf of the organization; effective access still depends on the connection's permission model and the accessing user's permissions.

The scopes listed here are representative and can change. The exact set of scopes requested for a connection appears on the Microsoft consent screen when a user connects.

The following table lists the scopes for SharePoint and OneDrive files:

Scope	Purpose
Sites.Read.All	Read items in all site collections so a connection can search SharePoint sites.
Sites.ReadWrite.All	Read and write items in all site collections.
Files.Read.All	Read all files the signed-in user can access.

The following table lists the scopes for Microsoft Teams:

Scope	Purpose
Chat.Read	Read the signed-in user's chat messages.
Channel.ReadBasic.All	Read channel names and descriptions the signed-in user can access.
ChannelMessage.Read.All	Read messages in channels the signed-in user can access.
ChatMessage.Send	Send chat messages on behalf of the signed-in user.
ChannelMessage.Send	Send channel messages on behalf of the signed-in user.
Team.ReadBasic.All	Read the names and descriptions of teams the signed-in user can access.

The following table lists the scopes for Outlook mail:

Scope	Purpose
Mail.Read	Read the signed-in user's mail.
Mail.Read.Shared	Read mail the signed-in user can access, including shared and delegated mailboxes.
Mail.ReadWrite	Read and write the signed-in user's mail.

The following table lists the scopes for Calendar:

Scope	Purpose
Calendars.Read	Read events in the signed-in user's calendars.
Calendars.Read.Shared	Read events in calendars the signed-in user can access, including shared calendars.
Calendars.ReadWrite	Read and write events in the signed-in user's calendars.

The following table lists the scopes for online meetings:

Scope	Purpose
OnlineMeetingTranscript.Read.All	Read transcripts of the signed-in user's online meetings.
OnlineMeetingAiInsight.Read.All	Read AI-generated insights, such as meeting notes, from the signed-in user's online meetings.
OnlineMeetingArtifact.Read.All	Read artifacts, such as attendance reports, from the signed-in user's online meetings.
OnlineMeetingRecording.Read.All	Read recordings of the signed-in user's online meetings.

The following table lists the scopes for identity and authentication:

Scope	Purpose
User.Read	Read the signed-in user's profile to identify them.
User.ReadBasic.All	Read basic profiles of other users to resolve people referenced in content.
offline_access	Maintain the connection with a refresh token so the user doesn't reauthenticate on every request.
openid	Sign the user in with OpenID Connect.
profile	Read the user's basic profile during sign-in.
email	Read the user's email address during sign-in.

If needed, allowlist the following redirect URIs that managed OAuth uses:

Cloud	Redirect URI
AWS	https://oregon.cloud.databricks.com/api/2.0/http/oauth/redirect
Azure	https://westus.azuredatabricks.net/api/2.0/http/oauth/redirect
GCP	https://us-central1.gcp.databricks.com/api/2.0/http/oauth/redirect

For managed OAuth providers with a published MCP server, such as Glean, GitHub, Atlassian, and Slack, Azure Databricks can manage the OAuth credentials when you register the server as an MCP Service. See Managed OAuth providers.