Azure Databricks - Scope of SecretScope

Question

All,

What is the scope for Key-Vault backed Secret? Is it the entire workspace? Which means does it mean all the users defined in the workspace will have access to the SecretScope which in turn means access to all the secrets that are a part of the SecretScope in question?

Thanks,
grajee

Answer 1

Hello @Gopinath Rajee ,

Thanks for the question and using MS Q&A platform.

If you are creating an Azure Key Vault-backed secret scope using the UI

Scopes are created with permissions controlled by ACLs. By default, scopes are created with MANAGE permission for the user who created the scope (the “creator”), which lets the creator read secrets in the scope, write secrets to the scope, and change ACLs for the scope.

For more details, refer to Azure Databricks - Secret scopes & Secret access control.

If you are creating an Azure Key vault-backed secret scope using programmatically using databricks CLI - you need to grant RBAC permission for associated Enterprise application called "AzureDatabricks".

For more details, refer to Databricks Support Azure Keyvault backed Secret Scope where Azure Keyvault uses RBAC instead of Access Policy.

Hope this will help. Please let us know if any further queries.

------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators