Create and manage model provider services

Important

This feature is in Beta. Account admins can manage access to this feature from the account console Previews page. See Manage Azure Databricks previews.

This page describes how to create a model provider service, grant access to it, configure Unity AI Gateway features, and delete it.

Requirements

• Unity AI Gateway preview enabled for your account. See Manage Azure Databricks previews.
• CREATE SERVICE on the schema where you create the model provider service, plus USE CATALOG and USE SCHEMA on its catalog and schema.
• CREATE CONNECTION on the same schema. Creating a model provider service with inline credentials stores them in a Unity Catalog connection, which requires this privilege.
• The credentials for the external provider you want to register (for example, an OpenAI API key or an AWS access key pair).

Create a model provider service

Model provider services and model services share a single name namespace within a Unity Catalog schema. You can't use a name for a model provider service if a model service in the schema already uses it, and vice versa.

Use the UI

1. Do one of the following:
   • In the workspace sidebar, click AI Gateway, then open the Providers tab and click Create.
   • In Catalog Explorer, go to the schema where you want to create the model provider service, then click Create > Service > Model provider service.
2. Enter a name for the model provider service, and select the catalog and schema to create it in. If you start from Catalog Explorer, Catalog Explorer prefills the catalog and schema.
3. Select the provider type, and enter the provider's connection details and credentials.
4. Click Create. Azure Databricks encrypts and stores the credentials. The UI does not display them after this point.

For the full list of providers and their authentication methods, see Model provider services in Unity Catalog.

Grant access

To let others query a model provider service, grant them EXECUTE on the model provider service and USE CATALOG and USE SCHEMA on its catalog and schema. If the model provider service logs to an inference table, grant SELECT on the table to let them read the logged requests and responses.

To grant access in Catalog Explorer:

1. In Catalog Explorer, open the model provider service.
2. On the Permissions tab, click Grant.
3. Select the users or groups to grant access to, select the EXECUTE privilege, and click Grant.

Make sure the same principals also have USE CATALOG and USE SCHEMA on the model provider service's catalog and schema. To let them read logged requests and responses, grant SELECT on the inference table from its Permissions tab.

For more about granting and discovering access, see Discover and govern access to model provider services.

Configure features

Because a model provider service routes through Unity AI Gateway, apply the same governance and observability features you use for other Unity AI Gateway traffic:

• Inference logging. Log requests and responses to a Unity Catalog table. See Monitor model services using inference tables.
• Rate limits. Cap queries per minute to manage capacity and cost. See Configure rate limits for AI services using Unity AI Gateway.
• Service policies. Govern the content of each interaction — for example, block unsafe content or redact sensitive data — by attaching a service policy. See Service policies for AI securables and Create and attach a service policy.

Delete a model provider service

To delete a model provider service, you must have at least the MANAGE privilege on it. The owner has a superset of MANAGE.

To delete a model provider service, open it in Catalog Explorer and select Delete from the kebab menu. Deleting a model provider service removes its stored credentials.

Next steps

• Query model provider services
• Discover and govern access to model provider services
• Model provider services in Unity Catalog