Connect Azure Databricks to DSPM

Overview

Netskope DSPM supports scanning of Azure Databricks Data Stores. Follow these instructions to prepare your Azure Databricks environment and connect it to the Netskope DSPM platform.

Create an Azure Databricks Service Account

Netskope DSPM requires programmatic access to connect to and scan your Azure Databricks Data Stores, including assigning specific user permissions. Please follow the steps below to create the necessary configurations within the Azure Databricks console.

More information about creating Azure Databricks users is available here.

Creating a Netskope DSPM-specific service account will require a dedicated email account to use during configuration. Please work with your organization to have this made available before continuing.

Create and Configure Netskope DSPM User

Begin by accessing your Azure Databricks workspace from your Azure portal, then clicking on the Azure Databricks icon. 

1. Click on the name of the Azure Databricks Service on the left hand side. 
2. Click the Launch Workspace button to launch your Azure Databricks console.

Take the following steps within your Azure Databricks console to create and configure a Netskope DSPM-specific service account. Ensure you are logged in as an admin user.

1. From the upper right dropdown next to your email, navigate to Admin Settings. 
2. You’ll see a list of usernames and their permissions on the Users tab.
3. Click the Add user button. 
4. The Add User modal is displayed.
5. Complete the Email field, using the value that corresponds to the Netskope DSPM-specific user.  
6. Click the OK button.
7. When the invitation arrives at the specified email address, click the link to accept the invitation.
8. Navigate back to Admin Settings.
9. On the Users tab, for the user you just added, grant the following permissions:
   • Workspace access
   • Databricks SQL access 

10. Navigate to the Workspace Settings tab.
11. Under the Access Control section > Personal Access Tokens section
    • Ensure that the section is enabled.
    • Click on the Permission Settings button.
12. The Permission Settings modal is displayed.
13. Add the above Netskope DSPM-specific username to the list and grant the “Can Use” permission by clicking the + Add button.
14. Click the Save button. 

Generate the Access Token

Next, you will use the Netskope DSPM-specific service account to generate the access token that Netskope DSPM requires for connecting to your Azure Databricks instance.

1. Log back into your Azure Databricks instance using the first steps in the Create and Configure Netskope DSPM User section above.
   • Log in as the Netskope DSPM-specific service account which was created above.
2. From the upper right dropdown next to your email, click User Settings. 
3. The Access tokens tab of the User Settings screen is displayed.
4. Click the Generate new token button.
5. The Generate New Token modal is displayed
6. Complete the following fields:
   • Comment: any value, although it is recommended you note it is used by Netskope DSPM
   • Lifetime (days): any value, including blank (indefinite)
7. Make note of the generated token, which will later be used within Netskope DSPM for connecting your Azure Databricks Data Stores
8. Click the Done button.

Configure the Azure Databricks Cluster

1. Within your Azure Databricks instance, hover over the D icon in the upper left and click Compute.
2. Click on the name of the cluster being used by Netskope DSPM to view its details.
3. On the top-right, click the More… button, then select Permissions.
4. The Permission Settings modal is displayed.
5. Add the above Netskope DSPM-dedicated username to the list & grant the “Can Manage” permission.
6. Click the Save button.                                                    
7. On the Configuration tab, click the arrow to the right of Advanced Options to expand its contents.
8. Within the expanded contents, click the JDBC/ODBC tab.
9. Make note of the following highlighted portions, which will later be used within Netskope DSPM for connecting your Azure Databricks Data Stores:

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Field	Value
Data Store Identifier	Friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Server	Enter the Server Path value from the Configure the Azure Databricks Cluster step above.
HTTP Path	Enter the corresponding value from the Configure the Databricks Cluster step above.
Username (Email) Service Principal Application ID	Enter the email address for the Netskope DSPM-dedicated user created in the Create and Configure Netskope DSPM User sub-step above. Alternatively, enter any existing Service Principal Application ID.
Token	Enter the corresponding value from the Generate Access Token sub-step above, or the token associated with the Service Principal Application ID provided. If your token is configured to eventually expire, in the future you will need to generate a fresh token then update these configurations within Netskope DSPM in order for the platform to continue scanning your Databricks Data Stores.
Scan Frequency	Controlling how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override if (desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Feature	Supported for Azure Databricks?
Discovery	Yes (always-on)
Privilege Analysis	No
Shadow Data Analysis	No
Classification	Yes
Data In Use Monitoring	Yes (custom query logs only)
Automation	Yes (always-on)

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.