---
title: Configuring Databricks AI
description: Connect PingOne Privilege to Databricks so AI discovery can review its agent inventory.
component: privilege
page_id: privilege:agent-privilege:configuration/workload-agent-apps/databricks-ai
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/workload-agent-apps/databricks-ai.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 21, 2026
---

# Configuring Databricks AI

Connect Databricks as a workload agent application so AI discovery for workload agents can review the agents running in the workspace. Learn more in [Discover and manage workload agents](../../use-cases/workload-agents.html).

1. In the PingOne Privilege admin console, go to **AI Security > Workload Agents**.

2. Click the **Add Application** tab.

3. In the list of available applications, find **Databricks AI** and click **[icon: plus, set=fa]Integrate**.

4. Enter a **Name** for the connection.

5. (Optional) Enter a **Description**.

6. Click **Next**.

7. To configure **Permissions**, you can either:

   * Create a Databricks service principal with the following permissions:

     * `GET /api/2.0/serving-endpoints`

     * `GET /api/2.0/permissions/serving-endpoints/<id>`

     * `GET /api/2.0/genie/spaces`

     * `CAN_VIEW` (or higher) on each serving endpoint

     * `CAN_MANAGE on the serving endpoint`

     * `PATCH /api/2.0/serving-endpoints/<name>/tags`

     * `PUT /api/2.0/serving-endpoints/<name>/ai-gateway`

     * `PATCH /api/2.0/permissions/serving-endpoints/<id>`

     * `PATCH /api/2.0/permissions/serving-endpoints/<id>`

     * `PATCH /api/2.0/permissions/serving-endpoints/<id>`

       |   |                                                                                                                                               |
       | - | --------------------------------------------------------------------------------------------------------------------------------------------- |
       |   | Foundation Model API endpoints (no endpoint ID) do not support permission management.Genie spaces do not support permission write operations. |

   * Generate a personal access token:

     1. In your Databricks workspace, click **User Settings**.

     2. Go to **Developer > Access Tokens**.

     3. Click **Generate new token**.

     4. For service principals, use the Databricks CLI or the System for Cross-domain Identity Management (SCIM) *(tooltip: \<div class="paragraph">
        \<p>An application-level, HTTP-based protocol for provisioning and managing user identity information. SCIM supplies a common schema for representing users and groups and provides a REST API.\</p>
        \</div>)* API to create the principal and generate an OAuth M2M token.

8. When you are finished setting up **Permissions**, click **Next**.

9. Enter your **Workspace URL** and generated **Access Token**. Click **Next**.

10. Review the summary, then click **Add Connection**.

You can now validate that the connection is active in the **Active Applications** tab.