> For the complete documentation index, see [llms.txt](https://help.protecto.ai/getting-started/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.protecto.ai/getting-started/protecto-overview/introduction/add-new-data-source/databricks/add-service-principal-azure-ad-application-to-databricks.md).

# Add Service principal (Azure AD Application) to  Databricks

1. Create a group "protecto\_group" in databricks. 
2. Add service principal which was created in step 1 with the display name "protecto\_user". Reference link: [Adding Service Principal](https://docs.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/scim/scim-sp#add-service-principal)[ ](https://docs.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/scim/scim-sp#add-service-principal)[to databricks.](https://docs.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/scim/scim-sp#add-service-principal)
3. Add "protecto\_user" to the "protecto\_group

**List of accesses needed in Databricks:**

* Grant "SELECT", "USAGE", “READ\_METADATA” privilege for all catalogs, databases (or schemas) and tables for "protecto\_group".
* Create medium sized sql warehouse for Protecto and give "can manage" permission for "protecto\_group".
* Grant “can manage” permission to “protecto\_group” in all SQL warehouses on which the Protecto application needs to analyze. This is required to retrieve access logs (audit logs).