Connecting Azure Databricks to Churney

At a glance: Entra ID only, no secrets · Personal data hashed in your workspace · Files expire after one day

Churney logs in to your SQL warehouse as an Entra ID application you register, with short-lived federated tokens. Each sync writes the hashed views as Parquet to a storage container you own, and we copy the files out. Anything that identifies a person is hashed before it leaves your workspace.

Let Claude set it up

Before you start

• Unity Catalog, with your raw tables in a catalog
• A SQL warehouse Churney can use. Serverless is cheapest to keep idle.
• Workspace admin rights, and rights to create an app registration, a storage account, an Access Connector and role assignments in Azure
• The Azure CLI, logged in with az login and the databricks extension
• Two Google identity ids, which we send you. Every step before step 4 works without them.

What to share

As much as you can. Each of these makes the predictions better:

• Payments
• Trials, if you have them
• User demographics, if available
• User activity
• Attribution: your source of truth for campaign performance (UTM, MMP or ad network)

Step 1. Create the hashed views

Create two schemas in your catalog. churney_views holds the views. churney_exports stays empty: we write temporary tables there during each sync.

Create the schemas

Then create one view per table you share. Each view hashes the columns that can identify a person, such as email, phone, name, birthday and street address, and passes everything else through unchanged. Give every event table a TIMESTAMP column, such as created_at, for incremental loads.

Fill in your names below and copy the SQL. Rather we write the views for you? Use the List your columns tab and send us the result.

Open the SQL builder

Then check a hash. Paste an email or phone number you know is in your data and compare the result with what your view returns.

Open the hash checker

Step 2. Create a storage container

Set up the CLI first. The token is scoped to Azure Databricks only.

Set up the CLI

Create an ADLS Gen2 account in the region of your workspace. Storage account keys are switched off and files expire after one day.

Create the storage account and container

Step 3. Give Unity Catalog write access

An Access Connector is a managed identity that Unity Catalog uses to write to the container. Unity Catalog also needs you to hold Contributor on it directly.

Create the Access Connector

Wait a minute for the role assignments to apply, then register the credential and the external location.

Register the external location

Step 4. Register the Churney application

The application trusts two Churney Google identities instead of a client secret. Use the ids we sent you.

Register churney-sync

Add it to the workspace and let it use the SQL warehouse. The warehouse ID is the last part of its HTTP path.

Add it to the workspace

Finally, run the grants in the SQL editor with the application (client) ID.

Grant access

Step 5. Send us the details

• The Azure region of your workspace
• The tenant ID: az account show --query tenantId -o tsv
• The application (client) ID of churney-sync: echo $APP_ID
• The workspace host and the SQL warehouse HTTP path, under Connection details
• The catalog name
• The storage account and container names
• The view names, and the timestamp column to use for incremental loads on each

We fill these in and run the first sync. There is nothing else to set up on your side.

What happens on our side

No action needed. This is here for your security review.

• No secrets. No personal access token, client secret, SAS token or storage key is ever exchanged. Churney's Google identity gets a one-hour Entra ID token for churney-sync through the federated credential, and nothing is stored.
• Least privilege. The application can read the views in churney_views and write temporary external tables to churney_exports and your container. It has no access to your raw tables. Unity Catalog writes the files as your Access Connector's managed identity.
• Direct, incremental export. Each sync drops the previous run's tables, writes Parquet to a fresh folder in your container, and Google Storage Transfer Service copies it out. We pull only new or changed rows with a safety window for late data. Files expire after one day. The queries run on your SQL warehouse.
• Easy to revoke. Delete the churney-sync app registration or remove it from the workspace.

Normalization rules

Normalization rules