# Databricks

Workspaces come from the profiles in `~/.databrickscfg` (or
`$DATABRICKS_CONFIG_FILE`); account-console profiles are skipped. Each
workspace is a source, its secret scopes are the vaults.

Credentials are resolved the same way as the Databricks CLI, so
`auth_type = azure-cli` uses your az login and OAuth profiles use
`databricks auth login`. When a login expires, `L` runs the right one for
that profile.

Secrets in Azure Key Vault-backed scopes are read through Databricks; if
Databricks refuses, lazysecrets reads the backing vault directly with your
az login (which then needs the [Key Vault roles](azure.md#permissions)).

On a scope, the right pane shows who has access to it and how much
(manage, write, read). Databricks shows that only to the scope's
managers; to others it says so.

Hide profiles you don't want in the [config](config.md):

```yaml
providers:
  databricks:
    hideProfiles: [test]
```