PingOne Privilege

Configuring Databricks AI

Connect Databricks as a workload agent application so AI discovery for workload agents can review the agents running in the workspace. Learn more in Discover and manage workload agents.

  1. In the PingOne Privilege admin console, go to AI Security > Workload Agents.

  2. Click the Add Application tab.

  3. In the list of available applications, find Databricks AI and click Integrate.

  4. Enter a Name for the connection.

  5. (Optional) Enter a Description.

  6. Click Next.

  7. To configure Permissions, you can either:

    • Create a Databricks service principal with the following permissions:

      • GET /api/2.0/serving-endpoints

      • GET /api/2.0/permissions/serving-endpoints/<id>

      • GET /api/2.0/genie/spaces

      • CAN_VIEW (or higher) on each serving endpoint

      • CAN_MANAGE on the serving endpoint

      • PATCH /api/2.0/serving-endpoints/<name>/tags

      • PUT /api/2.0/serving-endpoints/<name>/ai-gateway

      • PATCH /api/2.0/permissions/serving-endpoints/<id>

      • PATCH /api/2.0/permissions/serving-endpoints/<id>

      • PATCH /api/2.0/permissions/serving-endpoints/<id>

        Foundation Model API endpoints (no endpoint ID) do not support permission management.

        Genie spaces do not support permission write operations.

    • Generate a personal access token:

      1. In your Databricks workspace, click User Settings.

      2. Go to Developer > Access Tokens.

      3. Click Generate new token.

      4. For service principals, use the Databricks CLI or the System for Cross-domain Identity Management (SCIM) API to create the principal and generate an OAuth M2M token.

  8. When you are finished setting up Permissions, click Next.

  9. Enter your Workspace URL and generated Access Token. Click Next.

  10. Review the summary, then click Add Connection.

You can now validate that the connection is active in the Active Applications tab.