Databricks now deletes unused OAuth secrets after 90 days

Picture this. It's quarter-end. The finance team's reporting job, untouched since the last quarter-end, kicks off at 2 AM and fails with an authentication error. Nobody changed the code. Nobody changed permissions. The network is fine.

The cause: the job's credential was quietly deleted weeks ago, because it hadn't been used in 90 days.

Since 16 September 2026, that's how Azure Databricks works. It's a good security change, but it breaks exactly the jobs you think about least.

Service principals and secrets, in plain language

A service principal is a robot account. People log in as themselves, but a scheduled job, a Terraform pipeline or a GitHub Actions workflow needs its own identity. That's the service principal.

An OAuth secret is the robot's password. The robot shows its ID and secret to Databricks and gets back an access token valid for one hour. When the token expires, it asks for a new one.

Think of a contractor's office badge. The badge gets them through the gate, where they collect a day pass to work inside. The badge is the secret; the day pass is the token.

What changed

Azure Databricks now automatically deletes a service principal's OAuth secret after 90 days without use. It already did the same for unused personal access tokens; OAuth secrets now follow the same rule.