Set Up OIDC Authentication for Delta Sharing Connections

OpenID Connect (OIDC) is an authentication method used to access Analytics data for Databricks Delta Sharing connections as an alternative to Personal Access Tokens (PATs). OIDC authenticates your data connection through your organization's Identity Provider (IdP), such as Microsoft Entra ID or Okta. It uses short-lived, automatically rotated credentials instead of a static bearer token. For details on when to use OIDC instead of the PAT authentication method, see What is the difference between OIDC and PAT authentication?

• Required User Permissions

• Additional Information:

  • Supported Data Platforms:

    • AWS

    • Azure

    • BigQuery

    • Power BI

    • Snowflake

    • SQL Server

  • OIDC authentication is available for new delta sharing connections. Existing data connections using PAT and recipient tokens continue to function independently without requiring migration to OIDC.

  • It may take up to 24 hours for data to become visible in your data warehouse or Power BI tool after a new connection is established.

• You must have the Analytics tool enabled at the Company level for your company's Procore account.

• Your organization must use an identity provider that supports OIDC, such as Microsoft Entra ID or Okta.

• Configure Your Identity Provider

• Configure OIDC Authentication in Analytics

1. Reach out to your organization's identity administrator to register Analytics Delta Sharing as an application (or federation policy) in your identity provider.

2. Retrieve the following values generated by your IdP to use during setup in Analytics:

   • Issuer URL: The HTTPS URL of the IdP issuing the JSON Web Token (JWT).

   • Subject Claim: The JWT claim type used to identify the authenticating identity.

   • Subject: The specific user, group, or application identifier within your IdP.

   • Audiences: The intended recipients of the JWT.

1. Navigate to the Company level Analytics tool.

2. In the Data Connectors tab, locate the Connect Your Data panel.

3. On the OpenID Connect (OIDC) card, click Begin Setup.

4. In the Configure OIDC Authentication modal, provide the following information:

   1. Issuer URL. Enter the HTTPS URL of your IdP.

      • Entra ID Format: https://login.microsoftonline.com/{tenantId}/v2.0.

   2. Subject Claim. Select one of the following JSON Web Token (JWT) claim types corresponding to your identity configuration:

      • oid - Object ID (user, U2M)

      • groups - group of users (U2M)

      • azp - OAuth application (M2M)

      • sub - other identity providers
        Note: By default, 'oid - Object ID (user, U2M)' is selected.

   3. Subject. Enter the user, group, or application identifier that the JWT is bound for.

   4. Audiences. Enter the intended recipient(s) of the JWT. Separate multiple values with a comma.
      

      Note

      • If you are using Entra ID for a Power BI data connection, enter 64978f70-f6a6-4204-a29e-87d74bfea138.

      • If you are using Entra ID for a Python data connection, enter the resource ID.

5. Click Continue.

6. In the Your Connection Is Ready modal, copy or download the appropriate connection credentials for your data tools:

   • Machine-to-Machine (M2M): An OAuth client-credentials profile (m2m-profile.share) for automated, server-to-server access.

     • Click the Download .share icon to download the profile file to your system.

     • Click the copy icon to copy the JSON contents to your clipboard.
       

       Important

       The M2M profile includes placeholder values. You must replace the values for clientId, clientSecret, and scope with your application’s client credentials before sharing or using the file.

   • Power BI: Use the connection URL to connect directly to Power BI.

     • Click the caret icon next to Power BI to expand the section.

     • Click the copy icon next to Connection URL and paste it into the Delta Sharing connection dialog box in Power BI.

   • Tableau and Other BI Tools: An OAuth authorization-code profile (tableau-profile.share) to provide to your BI tool.

     • Click the Download .share icon to download the profile file to your system.

     • Click the copy icon to copy the JSON contents to your clipboard.
       

       Note

       You can access the credentials for these connection profiles at any time after setup under the Credentials tab on the OIDC Authentication card.

7. Click Done.

8. Explore the additional sections of the Getting Started With Analytics 2.0 guide for next steps in connecting your data to your preferred data warehouse.