Getting started
This walks you from an empty workspace to reading effective access. It takes a few minutes plus one scan.
1. Connect a Databricks account
In Accounts, connect your Databricks account with a service principal that has read access. The account-level service principal discovers every workspace beneath it, so one connection covers your whole estate.
Two ways to authenticate:
- Client secret - paste the service principal's client ID and secret. The secret is encrypted at rest.
- Federation (no secret, preview) - Mortar signs a short-lived token your Databricks service-principal federation policy trusts, so no secret is stored. In preview and available to design partners as we validate it against production Databricks; stored-secret is the default.
The scanning identity is read-only. It cannot write to your estate by construction; see How changes execute.
2. Choose which workspaces to scan
After connecting, Mortar lists the workspaces under the account. Include the ones you want governed. New workspaces default to excluded, so nothing is scanned without your say-so.
3. Run a scan
Trigger a scan from the account, or set a schedule (cron) so it runs automatically. A scan reads groups, memberships, catalog and object grants, secret-scope ACLs, and (where available) admin footprint - then computes posture, findings, and drift against the previous scan.
Optional but recommended: connect a SQL warehouse. With one configured, Mortar reads Databricks system tables to unlock usage-based governance - "last actually used" on grants, unused-access detection, drift attribution, and auto-classification of sensitive catalogs. Without it, those surfaces show a dash rather than guessing.
4. Read your estate
Once a scan completes:
- Effective access - type a principal or a catalog and see the full resolved reach.
- Risks - the triage worklist of over-privileged, unused, and risky access.
- Dashboard - a single posture verdict: are you OK, or not.
From there, Detect & govern covers drift, reviews, certifications, and compliance policies.