Dashboards: registry of Databricks AI/BI (Lakeview) dashboards¶

Import the published Databricks Lakeview dashboards your teams already built, organise them into role-gated groups, and render them natively inside Datahub — without handing out Databricks workspace access.

Dashboards is the read-only counterpart to Insights: it surfaces the Lakeview dashboards your teams publish in Databricks, where Insights authors dashboards inside Datahub. If your organisation has invested in Lakeview but struggles with discoverability, governance, and consistent access, this is where those dashboards belong.

SourceDatabricks Lakeview

Import identityService Principal · OAuth U2M

Access modelGroup → role group

Genie preview5 queries / min

When to choose this¶

Surface dashboards teams already built

Publish Lakeview dashboards to the right business users without sharing Databricks workspace access.
Gate access by group

Group dashboards by region, business unit, country, or topic and map each group to role groups. Readers see only their groups; managers see all.
Star your go-to dashboards

Per-user favourites pin the dashboards you use most to the top of the gallery.
Ask Genie about the data

Ask a dashboard a natural-language question — "What was revenue in Q4?" — answered through its companion Genie space.

When not to reach for Dashboards

Authoring a new dashboard inside Datahub → use Insights.
Embedding non-Lakeview BI (Power BI, Tableau, Looker) → Lakeview only, for now.
Connecting through a PAT integration → import and embedding need a Service Principal or OAuth U2M identity.
Enforcing per-user row-level security on an embedded dashboard → embedding mints under the workspace Service Principal; build it in Insights instead.

How a dashboard reaches Datahub¶

Datahub never authors or mutates anything in Databricks. It lists the dashboards a workspace has already published, imports the references you pick into a role-gated group, and renders them in a governed gallery and viewer.

flowchart LR
    DBX["Databricks workspace<br/>published Lakeview dashboards"] --> DISC["Discover<br/>list not-yet-imported"]
    DISC --> IMP(["Import<br/>assign to a group"])
    IMP --> REG[("Datahub registry<br/>reference + embed URL")]
    REG --> GRP["Group → role-group access"]
    GRP --> GAL["Gallery<br/>filtered by your access"]
    GAL --> VW["Viewer<br/>SDK embed · per-user viewer id"]
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class IMP accent

Figure 1 — Discovery lists a workspace's published dashboards; import registers the ones you choose into a group and stores only a reference plus the embed URL. Group → role-group access then decides who sees each dashboard in the gallery and viewer. No dashboard is ever changed in Databricks.

Why teams reach for this

Lakeview dashboards become discoverable and governed without giving anyone a Databricks seat. Access is driven entirely by role groups, starring keeps favourites one click away, and every embed carries the viewer's email so Databricks audit trails stay per-user.

Concepts¶

Concept	What it is
Workspace	A registered Databricks workspace integration. Import and embedding require Service Principal or OAuth U2M; PAT is blocked.
Dashboard	A reference to a published Databricks Lakeview dashboard — name, description, embed URL, owning group.
Group	A logical collection of dashboards (e.g. EMEA, Finance, Customer Success), each mapped to one or more Datahub role groups.
Group access	The mapping from a dashboard group → role groups → users. Readers see only the groups they can access; managers see all.
Star	A per-user favourite that pins the dashboard to the top of the gallery.
Genie space	The Databricks Genie space companion to a dashboard. Auto-discovered when Genie is enabled on the dashboard, or admin-overridable per dashboard via `genie_space_id`.
Genie conversation	A natural-language Q&A session about a dashboard, powered by the Databricks Genie Conversation API and proxied through Datahub on the workspace credentials.

What Dashboards looks like¶

Surface	Where	What you see
Gallery	`/dashboards`	Card grid filtered by your group access. Each card: name, group badge, star toggle, description. Group filter dropdown. Starred dashboards pin to the top.
Group management	`/dashboards/groups`	Managers create / edit / delete groups and assign role groups.
Viewer	`/dashboards/{id}`	Embedded SDK rendering of the Lakeview dashboard. Ask Genie button on the toolbar opens a slide-in chat panel.
Import modal	Gallery → Import	Pick a Service-Principal-or-OAuth-U2M workspace → published dashboards not yet imported → assign to a group → import.

Setup — what an admin needs to do once¶

Prereq	Where	Why
Databricks integration	`/admin/integrations` → Databricks	Service Principal or OAuth U2M. PAT is blocked from import and embedding.
Embedding enabled in the workspace	Databricks workspace settings	Embedding must be on and the destination domain approved. Datahub reads the workspace's embedding policy and approved domains to surface them.
Roles	`/rolegroups`	`dashboards.read` — view the gallery and open the viewer (filtered by group access). `dashboards.manage` — import, edit, deactivate, and manage groups + group access.
Groups	`/dashboards/groups`	Create groups for the access model you want and map each to role groups.
(Optional) Genie space override	`/dashboards/{id}` admin form	If auto-discovery doesn't find the right Genie space, set the ID manually.

Datahub seeds a Default group on install and assigns existing dashboards to it, so nothing is orphaned before you build your own groups.

Importing a dashboard¶

Open /dashboards → Import.
Pick the Databricks workspace (Service Principal or OAuth U2M; PAT integrations don't appear).
Datahub lists the workspace's published Lakeview dashboards that aren't registered yet. Unpublished dashboards are filtered out.
Select dashboards and assign them to a group — existing, or create one inline.
Import — Datahub fetches each dashboard's published version to get the embed URL, then stores the reference locally. Nothing is changed on the Databricks side.

To deregister, use Delete on the dashboard row — Datahub forgets the reference; the dashboard stays in Databricks untouched.

Group-based access¶

The access model is intentionally simple:

Role	What they see
`dashboards.read` (Reader)	Only dashboards in groups they can access via their role groups.
`dashboards.manage` (Manager)	All dashboards across all groups.

So an EMEA Finance reader in the EMEA Finance role group sees only the dashboards in groups mapped to that role group; a manager sees everything. Group assignments live at /dashboards/groups, and the role-group → group mapping is the source of truth.

Embedding¶

The viewer renders each dashboard with Databricks' official @databricks/aibi-client SDK. To keep embedding scoped and auditable, Datahub mints a short-lived embedding token in three steps and hands it to the SDK, which refreshes it automatically.

flowchart LR
    APP["Viewer opens<br/>a dashboard"] --> T1["1 · All-apis token<br/>native OIDC or Azure AD"]
    T1 --> T2(["2 · Dashboard tokeninfo<br/>external_viewer_id = your email"])
    T2 --> T3["3 · Scoped embedding token<br/>client_credentials or token-exchange"]
    T3 --> SDK["aibi-client SDK<br/>renders the dashboard"]
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class T2 accent

Figure 2 — The three-step embedding token mint. Step 2 stamps the viewer's email as external_viewer_id, producing the custom_claim Databricks requires for scoped embedding — and giving Databricks a per-user audit trail of who opened what.

Service PrincipalOAuth U2M (per-user)PAT (blocked)

Discovery, import, Genie, and embedding all run under the workspace Service Principal. Databricks-managed SPs authenticate with native OIDC (client_credentials + Basic auth); Azure-managed SPs authenticate through Azure AD, using OIDC token-exchange in step 3.

Discovery, import, and Genie run under the calling user's Databricks identity, so per-user Unity Catalog row-level security and audit apply to those operations. Embedding is the exception — it still mints under the Service Principal (see the note below).

Personal Access Token integrations cannot import or embed: the token-minting flow needs a Service Principal or OAuth U2M identity, so a PAT workspace never even appears in the import modal.

If a Service Principal flow isn't available, the viewer falls back to a plain iframe using the embed URL. PAT integrations don't get even that, because import is blocked for them.

Why embedded dashboards don't honour per-user RLS

Under OAuth U2M, discovery, import, and Genie run as the calling user, so per-user Unity Catalog RLS and audit apply. Embedding is deliberately not relaxed: the embedding identity model is per-organisation, so a rendered dashboard always mints under the workspace Service Principal. If a dashboard must enforce per-user RLS on what it shows, build it in Insights, where the calling user's identity runs the SQL.

Asking Genie¶

If a dashboard has a companion Genie space, the viewer's Ask Genie button opens a slide-in chat panel.

Type a natural-language question; Datahub proxies it to the Databricks Genie Conversation API using the workspace credentials.
Genie returns generated SQL plus tabular results; Datahub polls until the message completes.
The result header counts the whole answer. When Genie capped the answer, the header reads at least N rows and the table footer +N or more rows, not an exact count.
Past conversations are listed in the panel — re-open one, ask follow-ups, or start a new conversation.
During Public Preview, Genie is rate-limited to 5 queries / min / workspace.

Where Genie data lives

Genie conversations are ephemeral on the Databricks side — Datahub stores only the metadata it needs to navigate them, never the message bodies. Everything is proxied on the registered workspace's credentials, so no third party is involved.

Limitations¶

Limit	Why	Workaround
Lakeview only — no Power BI, Tableau, Looker.	First-class focus.	Other BI tools may follow; for now, link out from a Page or a Data Product.
PAT integrations can't import or embed.	The 3-step token flow needs a Service Principal or OAuth U2M identity.	Switch the integration to Service Principal or OAuth U2M.
Per-user RLS doesn't apply to embedded dashboards.	Embedding mints under the Service Principal.	Use Insights for per-user RLS.
Genie is rate-limited (5 / min / workspace) during Public Preview.	Databricks limit.	Throttle queries; wait.
Datahub doesn't author Lakeview dashboards.	Out of scope.	Author in Databricks; import the published version.
Genie answers depend on the Genie space's quality.	Databricks owns Genie.	Tune the Genie space in Databricks (table descriptions, sample questions).
Group access is binary per-group.	Simple model.	Create more granular groups if you need finer slicing.

Audit & compliance¶

Question a CISO might ask	Where to look
"Who can see this dashboard?"	Dashboard → group → role-group access.
"Who opened this dashboard last week?"	Every embed mints with `external_viewer_id = user.email`, so Databricks audit shows per-user opens; Datahub also logs viewer opens.
"Whose Databricks identity ran the queries inside this dashboard?"	Embedding: the workspace Service Principal. OAuth U2M discovery / import / Genie: the calling user. Embedding never honours per-user RLS.
"Did anyone import a dashboard they shouldn't?"	Import requires `dashboards.manage` and is auditable.
"Where does Genie data go?"	The Genie API on the registered Databricks workspace; Datahub proxies, so no third party is involved.
"Can a user star a dashboard they don't have access to?"	No — star endpoints are gated on the same access model.

Troubleshooting¶

Symptom	Likely cause	Fix
Workspace doesn't appear in the import modal	PAT integration.	Switch to Service Principal or OAuth U2M.
Embedding shows blank / "domain not approved"	The workspace embedding policy hasn't approved this domain.	Add `*.datahub.nl` (or your tenant domain) in Databricks workspace settings → Embedding.
Embedding fails with a token error	The 3-step token flow was rejected — commonly an Azure AD SP without token-exchange enabled.	Enable token-exchange on the SP, or fall back to a native Databricks OIDC SP.
Genie button missing	The dashboard has no companion Genie space.	Set `genie_space_id` manually on the dashboard's admin form.
Genie throws 429	Rate limit (5 / min / workspace).	Throttle; spread the workload across workspaces.
Star icon doesn't toggle	Backend cache lag.	Refresh; if it persists, file a ticket.
Per-user RLS not applied	Expected — embedded dashboards mint under the Service Principal.	Build in Insights for per-user RLS.
412 `DATABRICKS_OAUTH_CONSENT_REQUIRED` on import / Genie	OAuth U2M consent missing.	The UI prompts you to re-consent.