Databricks Query History Access change

📌

To keep all Monte Carlo functionality on Databricks, create the Databricks group databricks_pii_access (if it does not already exist) and add Monte Carlo's service principal to it now.

Databricks is rolling out a platform change, targeted for late June 2026, that masks SQL query text in the query_history system table for anyone outside this group.

Once masking is enabled, features that depend on query text might stop working until access is granted.

What's changing

Databricks is updating the query_history system table so that the statement_text column (the SQL text of each executed query) is masked by default. Going forward, only members of the databricks_pii_access group will be able to read query text. This is a Databricks platform change, not a Monte Carlo change.

When this takes effect

Databricks has not confirmed a fixed date. The change is targeted for a Databricks Runtime (DBR) release in late June 2026 and reaches each environment differently:

• All-purpose clusters: when your workspace upgrades to the latest DBR.
• SQL warehouses: the change lands on the preview channel first. Warehouses on the preview channel will see masking earlier.

What's affected if Monte Carlo loses access to query text

The following features rely on query text and might be impacted if Monte Carlo cannot read statement_text:

• Query Performance monitors and Query Performance Anomaly alerts
• Query Insights and the Performance page
• Field usage / column popularity signals
• Table activity (read/write counts, queried-tables detection)
• Impact Analysis users on incidents (paginated user lists with per-user query counts)
• Query Log Details drawer (the per-query drill-down across Monte Carlo)
• Discover Queries widget
• AI monitor recommendations that depend on query patterns

What you need to do to retain existing functionality

✅

If you have more than one Databricks integration, this will need to be repeated for each one.

1. Add Monte Carlo's service principal to databricks_pii_access.
   1. Identify the service principal that Monte Carlo uses to authenticate to your Databricks workspace. This is the same service principal you configured when connecting Databricks to Monte Carlo. You can find it in Monte Carlo → Settings → Integrations → Databricks (under the connection's service principal field).
   2. In your Databricks account, create the databricks_pii_access group if it does not already exist, then add the service principal(s) to it. See the Databricks documentation on managing groups for details.
2. Verify membership
   1. You can confirm the service principal is in the group by running the following as an account admin, replacing the member name with your Monte Carlo service principal
      Example

      SELECT *
      FROM system.information_schema.group_members
      WHERE member_name = '<monte-carlo-service-principal>';

3. Verify Monte Carlo collection after masking activates
   
   Once masking activates in your environment, confirm that Monte Carlo is still receiving query history from Databricks:
   1. In Monte Carlo, open any Databricks table.
   2. Go to the Queries tab.
   3. Confirm that recent queries are appearing.
      If queries stop, the service principal is likely not in the group. Re-check the group membership in Databricks.

To enable further filtering in Monte Carlo in addition to your Databricks access controls, see PII filtering.

Need help?

For questions about the Databricks change itself (timing, the access policy, group behavior), contact Databricks support. For help with the Monte Carlo side of the setup, contact your Monte Carlo account team or open a support request.