Lets automation call Azure Databricks by having a service principal swap its OAuth client ID and secret for short-lived access tokens, known as the client credentials flow; this machine-to-machine approach is the preferred one for unattended processes.
Also called OAuth machine-to-machine.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains M2M in context, with comparison tables and the common traps.
Terms in this definition
- Databricks
Analytics platform built on Apache Spark where data is processed in notebooks; Unity Catalog is the governance model it recommends.
- HAVING
Applies a condition to groups produced by GROUP BY, often on an aggregate such as SUM(). WHERE works earlier, on individual rows before they are grouped.
- Service principal
The tenant-local instance of a managed identity or app registration, which users and Azure or directory roles are assigned to. Those from app registrations authenticate with a stored certificate or secret that needs rotating and can be copied, which suits code running outside Azure.
- OAuth
An authorisation standard allowing software to act for someone. In Azure Pipelines, choosing it for a GitHub service connection ties the connection to your own GitHub account; for integrations with Azure DevOps APIs, Microsoft Entra ID OAuth is the right choice.
- Client ID
Identifier presented at runtime by an application or user-assigned managed identity when it asks for tokens (acrUserManagedIdentityID, for instance). Role assignments use a different value, the principal or object ID, and the resource ID is different again.
- Secret
Object in Key Vault storing an arbitrary string value, for instance a password, API key or connection string.
- Client credentials
App-only OAuth 2.0 flow in which the application signs in as itself, not on behalf of a user; daemons, service-to-service calls and managed identities rely on it.
- Flow
The unit of work inside a Lakeflow pipeline that takes data from a source, transforms it and lands it in a destination like a streaming table. Streaming flows either append or update, and
CREATE FLOWlets you declare a flow apart from the table it feeds.
Related terms
- U2M
User-to-machine OAuth, where someone logs in interactively, usually through a browser, and the tool obtains short-lived tokens for them, for example via
databricks auth login. Its counterpart M2M is the unattended flow for service principals.