Metabase vs Databricks AI/BI dashboards on a Databricks SQL warehouse

Databricks AI/BI dashboards (formerly Lakeview dashboards) and Metabase both build dashboards on the tables in Unity Catalog, and both run their queries on a Databricks SQL warehouse. AI/BI dashboards live in your workspace. You share them with people who are registered in your Databricks account, or embed them for external users through a service principal. Metabase connects to the same warehouse with one read-only service principal, so the people who use Metabase don’t need Databricks accounts. Metabase’s open-source edition is free to run yourself, Metabase Cloud starts at $100 a month, and guest embeds with locked parameters work on every plan, including the free one.

Databricks renamed several products in 2026. Declarative Automation Bundles (formerly Databricks Asset Bundles) deploy dashboards as code, and Genie Agents (formerly Genie spaces) let people ask questions of their data in natural language. The REST API for dashboards keeps the old name, Lakeview. This page puts the Databricks way and the Metabase way side by side for each task: the connection, .lvdash.json files and bundle dashboard resources, dashboard_task subscriptions, embed_credentials, CAN_RUN permissions, sharing, embedding, AI and pricing. Prices and plan details were checked on October 30, 2026.

How do you connect Metabase to a Databricks SQL warehouse?

Metabase’s Databricks driver is an official connector that Metabase builds and manages, and it’s available in all editions, including open source. It connects to your workspace host on port 443 with SSL, and Metabase runs your queries directly in Databricks, so your reports stay up to date. Metabase Cloud supports Databricks too.

To add the connection, go to Admin > Databases > Add a database in Metabase and select Databricks. The form has these fields, in this order:

• Connection string fills in the other fields when you paste one.
• Display name is the name people see for this database in Metabase.
• Host is the Server hostname of your SQL warehouse, such as xxxxxxxxxx.cloud.databricks.com or adb-xxxxx.azuredatabricks.net.
• HTTP path is the warehouse’s HTTP path, which looks like /sql/1.0/warehouses/abcdef1234567890 or /sql/1.0/endpoints/abcdef1234567890.
• Authentication is a toggle between a personal access token (PAT) and a service principal with OAuth machine-to-machine (M2M) authentication. M2M is on by default, and it asks for the Service Principal Client ID and the Service Principal OAuth Secret.
• Enable multiple catalogs lets one connection sync several catalogs.
• Default catalog is required, so that your SQL questions don’t need to name the catalog.
• Catalogs and schemas syncs All, Only these or All except, and you can use * as a wildcard.
• Additional JDBC connection string options adds driver options to the connection string, such as IgnoreTransactions=0.
• Re-run queries for simple explorations can be turned off if people should click Run before each change in the query builder.
• Choose when syncs and scans happen sets when Metabase syncs table metadata and scans column values.
• Periodically refingerprint tables scans a sample of values every time Metabase runs a sync.

Set up a read-only service principal

Metabase signs in to Databricks in one of two ways: with a personal access token, or with a service principal and OAuth M2M. Use the service principal. Databricks lists connections from external applications for analytics among the uses of service principals. Service principals give “API-only access to Databricks resources, providing greater security than using user accounts.” These steps follow Databricks’s own docs:

• Create the service principal. As a workspace admin, open Settings > Identity and access, click Manage next to Service principals, and add one named metabase. Give it the Databricks SQL access entitlement, which grants access to dashboards, queries and SQL warehouses.
• Generate an OAuth secret. On the service principal’s Secrets tab, click Generate secret, set a lifetime of up to 730 days, and under Scopes select all APIs. The Databricks JDBC driver in Metabase requests the all-apis scope, and you can’t change a secret’s scopes after you generate it. Copy the secret and the client ID right away, because Databricks shows the secret only once, and the client ID is the service principal’s application ID.
• Let it use the warehouse. In the SQL warehouse’s Permissions dialog, give the service principal Can use, which lets it start the warehouse and run queries.
• Grant read access in Unity Catalog. To read a table, Databricks requires SELECT on the table, USE CATALOG on its catalog and USE SCHEMA on its schema. A SELECT grant on a schema covers every current and future table and view in that schema.

-- Run as the owner of the catalog and schema, or as a user with MANAGE on them.
-- A service principal is named by its application ID (the client ID), in backticks.
-- Follows Databricks's Unity Catalog privileges reference, GRANT and SHOW GRANTS docs.
GRANT USE CATALOG ON CATALOG analytics TO `fab9e00e-ca35-11ec-9d64-0242ac120002`;
GRANT USE SCHEMA ON SCHEMA analytics.gold TO `fab9e00e-ca35-11ec-9d64-0242ac120002`;
GRANT SELECT ON SCHEMA analytics.gold TO `fab9e00e-ca35-11ec-9d64-0242ac120002`;

-- Check what the service principal can now do on the schema.
SHOW GRANTS `fab9e00e-ca35-11ec-9d64-0242ac120002` ON SCHEMA analytics.gold;

To finish, copy the Server hostname and HTTP path from the warehouse’s Connection Details tab into the Metabase form. Leave M2M on, paste the client ID and the secret, and set the default catalog to analytics. Metabase reads table metadata from system.information_schema, which Databricks filters to the objects the service principal has privileges on, so Metabase lists the gold tables that you granted.

Metabase Cloud or your own cloud account

Metabase Cloud connects to your databases from IP addresses that Metabase publishes for each of its regions, three addresses per region. A Databricks workspace accepts connections from any IP address by default. If you restrict access with IP access lists, a Databricks feature on the Enterprise pricing tier, or with context-based ingress rules, allow the three addresses of your Metabase Cloud region. To keep Metabase inside your own cloud account instead, run the official metabase/metabase Docker image there, or metabase/metabase-enterprise for a Pro or Enterprise license, and keep Metabase’s own application data in a PostgreSQL database.

Does Metabase add a license, a service principal and a second copy of permissions?

Each question below is fair to ask before you add a BI tool to a Databricks stack, and each one has a short answer with Metabase.

Another license?

Databricks says that AI/BI has no additional license fees and that standard DBU rates apply. Metabase’s open-source edition is free too, with unlimited users, when you run it yourself. With either tool, your SQL warehouse bills the queries. On AWS in US East at the Premium tier, SQL Serverless costs $0.70 per DBU, and that price includes the cloud instance. The smallest size, 2X-Small, uses 4 DBUs an hour, which comes to $2.80 an hour. Metabase can answer repeat views from its cache instead of querying the warehouse again, and query caching works on every plan.

Metabase Cloud handles setup, backups and upgrades for you. Starter, a Metabase Cloud plan, costs $100 a month with 5 users included, then $6 per extra user per month. Pro costs $575 a month with 10 users included, then $12 per extra user per month, on Metabase Cloud or self-hosted. Enterprise starts at $20,000 a year. The price stays the same however many dashboards, queries or data sources you have, and people who only receive subscriptions or view guest embeds don’t need Metabase accounts. These prices were checked on October 30, 2026.

Another service principal?

Metabase needs one service principal, with read-only grants on the schemas it reads. AI/BI dashboards use one too when you publish with a service principal’s credentials, in the Publish dialog or through the REST API, or when you embed dashboards for external users. Each OAuth secret can be valid for up to two years. A service principal can hold up to five secrets, so you can add the next secret to Metabase before the current one expires.

A second copy of permissions?

Unity Catalog still sets the outer limit, because Metabase reads Databricks through its service principal and that principal’s grants. Inside that limit, Metabase groups decide who can open or edit each dashboard and who can build new questions, as the permissions section below shows. People sign in to Metabase with Google on every plan, or through SAML, JWT or OIDC with your identity provider on Pro and Enterprise.

In AI/BI, the default publishing mode, Share data permission, runs every viewer’s queries with the publisher’s data permissions. Databricks notes that this “might expose data to users who have not been granted direct access to it.”

A second place where metrics are defined?

Metabase queries your Delta tables through the SQL warehouse, so dashboards run on the same governed data that your pipelines produce. If dbt builds your gold tables, publish them to the Library, Metabase’s semantic layer of canonical tables and metrics, and define each metric there once, so people in the query builder and Metabot build questions from the same definition. On Pro and Enterprise, Remote Sync connects Metabase to a Git repository, so a change to a metric goes through pull request review, like a change to your bundle. Analysts can write a question in SQL, as they would write an AI/BI dataset. Everyone else can build questions on the same tables in the query builder, which picks data, joins tables, filters, summarizes and charts the results without SQL.

Copies of the data, a connector or a gateway?

Metabase runs each query directly in Databricks, so there’s no extract to refresh after your pipeline runs. The official Databricks driver connects straight to your workspace host on port 443 with SSL, in every edition of Metabase. To keep Metabase content in Git and in the same CI as your bundle, see the section on dashboards as code below.

dashboard_task subscriptions next to Metabase subscriptions in Slack and email

In AI/BI, you add a schedule to a dashboard, and each scheduled run sends a snapshot to its subscribers by email, Slack or Microsoft Teams. Email subscribers get a PDF and can also get CSV, TSV or Excel files, and an Excel file holds up to 100,000 rows. A subscription list holds up to 100 subscribers, and a workspace admin must set up Slack and Teams destinations before you can pick them.

To refresh and send a dashboard as part of a job, such as after a dbt build, you add a dashboard_task to the job instead. The task refreshes a published dashboard, needs a serverless or pro SQL warehouse, and keeps its own subscriber list, separate from the dashboard’s subscribers. In a bundle, dashboard_task takes dashboard_id, subscription and warehouse_id, and the dashboard must already exist.

Metabase sends dashboard subscriptions by email or Slack on every plan, hourly, daily, weekly or monthly. Email can go to people who don’t have a Metabase account, and you can add as many subscriptions to a dashboard as you like. An email subscription can attach a PDF of the dashboard and the results of the questions you pick as .csv or .xlsx files, with up to 1,048,575 rows per file by default. It can skip sending when the questions return no results, and Pro and Enterprise let you set different filter values for each subscription. On a self-hosted open-source Metabase, email goes through your own SMTP server, and Metabase Cloud manages one for you.

You can create subscriptions as code, too. The Metabase CLI, mb, is on every plan and works through Metabase’s API. With it, a coding agent or the CI job that deploys your bundle can set up a weekly email:

# Follows "Metabase CLI" (Metabase docs) and the metabase-cli README on GitHub.
npm install -g @metabase/cli

# In CI, store a Metabase API key in MB_API_KEY, then log in without a prompt.
mb auth login --url https://metabase.example.com --profile default

# List the cards on dashboard 10. Each row's card_id goes in "id" below,
# and the row's id goes in "dashboard_card_id".
mb dashboard cards 10 --json

# Every Monday at 8:00, email dashboard 10 to the ops and sales leads.
# "cards" names the dashboard's cards; include_csv attaches a card's results as CSV.
mb subscription create --body '{
  "name": "Weekly revenue report",
  "dashboard_id": 10,
  "cards": [{"id": 94, "dashboard_card_id": 87, "include_csv": true, "include_xls": false}],
  "channels": [{
    "channel_type": "email",
    "schedule_type": "weekly",
    "schedule_hour": 8,
    "schedule_day": "mon",
    "recipients": [{"email": "ops-leads@example.com"}, {"email": "sales-leads@example.com"}]
  }]
}'

For Slack, a channel uses "channel_type": "slack" and names the Slack channel in "details": {"channel": "#ops"}.

.lvdash.json files and bundle dashboard resources, next to Metabase dashboards as code

An AI/BI dashboard exports as one .lvdash.json file. In a bundle, the dashboard resource points at that file with file_path, and it also takes warehouse_id, embed_credentials, dataset_catalog, dataset_schema and permissions. The bundle rename doesn’t break anything, because the databricks bundle commands and your existing configuration stay the same.

Databricks’s docs add a few rules for this flow. Edits made in the UI don’t reach your local .lvdash.json until you run databricks bundle generate dashboard --resource <dashboard_key>, and databricks bundle deploy fails when the workspace copy differs from yours, unless you pass --force. With Git folders, Git tracks the draft but not publishing or schedules, and switching branches removes the dashboards that don’t exist on the target branch.

Metabase gives you three ways to keep dashboards as code. Remote Sync, on Pro and Enterprise, connects Metabase to a Git repository, so you can push and pull content as YAML files and review each change in a pull request. By default, it versions your Library, the canonical tables, metrics and dashboards you publish for people to use and Metabot to favor, along with your transforms. After you merge, your read-only production Metabase pulls in the change, and auto-sync can pull approved changes every five minutes. Git holds the YAML that describes your content, and your data stays in Databricks.

Serialization, also on Pro and Enterprise, exports and imports content as YAML files between Metabases, such as from a staging Metabase to production. The Metabase CLI, on every plan, reads and writes questions, dashboards and collections through the API, with commands such as mb dashboard create --file dashboard.json. The CLI is built for coding agents such as Claude Code, and its metabase-cli skill gives the agent instructions that match the CLI version it runs. On Pro and Enterprise, agent-driven development pairs the CLI with Remote Sync, so an agent builds content in a development Metabase and you merge its work like code.

Sharing and embedding: account users, embed_credentials and guest embeds

You share a published AI/BI dashboard with users and groups in your workspace or in your Databricks account. An admin must first register viewers from outside the workspace in your Databricks account, and they sign in with email and a one-time passcode, or with SSO. Users without workspace access are limited to CAN_RUN, even when you grant them more. In a bundle, embed_credentials: true runs every viewer’s queries with the credentials of the identity that deploys the bundle, and the default, false, uses each viewer’s own credentials.

Basic embedding puts the dashboard on your site, but each viewer must sign in with Databricks credentials and have third-party cookies turned on. Embedding for external users, generally available since March 12, 2026, serves people who have no Databricks account through a service principal and scoped access tokens. Your server passes a value that dataset queries read as __aibi_external_value, which filters the rows for each viewer. Tokens are valid for one hour, external embedding allows 20 dashboard loads per second, and the Ask Genie button isn’t supported there.

Metabase guest embeds work on every plan, including the free open-source edition, and viewers don’t need Metabase accounts. On the Open Source and Starter plans, guest embeds show a “Powered by Metabase” banner, which Pro and Enterprise remove. Your server signs a JWT that names the dashboard and sets its locked parameters, such as the customer ID from your app’s session. A locked parameter has no widget, and Metabase applies its filter before anything reaches the browser, so your app keeps deciding which customer sees which rows. Every token you sign must include a value for each locked parameter, and you choose how long each token lasts. SSO embeds with JWT or SAML, the React SDK and tenants are part of the Pro and Enterprise plans. For data you’re happy to show anyone, admins can also create a public link to a dashboard on every plan.

# app.py: pip install flask pyjwt
# follows the guest embeds page of the Metabase docs: publish dashboard 10 as a guest
# embed and set its customer_id filter to Locked.
import os
import time

import jwt
from flask import Flask, session

METABASE_URL = os.environ["METABASE_URL"]  # for example https://metabase.example.com
METABASE_SECRET_KEY = os.environ["METABASE_SECRET_KEY"]  # your embedding secret key

app = Flask(__name__)
app.secret_key = os.environ["FLASK_SECRET_KEY"]  # signs your app's own session cookie


@app.route("/reports")
def reports():
    # Your app's sign-in stores the customer ID in the session.
    customer_id = session["customer_id"]
    token = jwt.encode(
        {
            "resource": {"dashboard": 10},
            "params": {"customer_id": [str(customer_id)]},
            "exp": round(time.time()) + 10 * 60,  # 10 minute expiration
        },
        METABASE_SECRET_KEY,
        algorithm="HS256",
    )
    return f"""
<script defer src="{METABASE_URL}/app/embed.js"></script>
<script>
  window.metabaseConfig = {{ isGuest: true, instanceUrl: "{METABASE_URL}" }};
</script>
<metabase-dashboard token="{token}" with-title="true"></metabase-dashboard>
"""

CAN_RUN permissions, row filters and Metabase permissions

AI/BI dashboards have four permission levels: CAN VIEW, which the Permissions API and bundles call CAN_READ, then CAN_RUN, CAN_EDIT and CAN_MANAGE. CAN VIEW and CAN_RUN both let people view the dashboard, use its widgets, refresh it and clone it. CAN_EDIT adds editing and publishing, and CAN_MANAGE adds permission changes and deletion. Row filters and column masks from Unity Catalog apply to each viewer on dashboards published with individual data permissions. With shared data permissions, Databricks says that row-level security based on viewer identity does not apply. Databricks also notes that “Dashboard viewers can access all data in a dataset, even if it’s not shown in visualizations.”

In Metabase, each dashboard lives in a collection, and each group gets Curate access, View access or No access to that collection. View access lets a group open the dashboards and questions in it, and Curate access also lets the group edit, move and delete them. So the closest match for CAN_RUN is View access, and the closest match for CAN_EDIT is Curate access. Collection permissions are on every plan. Create queries permissions decide which groups can build their own questions, in the query builder only or in the SQL editor too.

Row and column security, on the Pro and Enterprise plans, shows each person specific data based on their user attributes, such as a region or a customer ID. Because Metabase queries Databricks through its service principal, you set these rules in Metabase, and the Unity Catalog grants still limit what the service principal can read.

Genie Agents and Metabot for questions in natural language

A Genie Agent is a chat interface where people ask questions of their data and get back SQL queries, results tables and visualizations. Each one needs data registered in Unity Catalog and a pro or serverless SQL warehouse, and it can hold up to 50 tables, views or metric views. Genie Agents moved to pay-as-you-go billing on July 8, 2026, with 150 free DBUs of LLM usage a month, which Databricks puts at about $10.50 in US East. Use by people is free through January 31, 2027, but service principals pay, and the SQL warehouse that runs Genie’s queries is billed separately. From February 1, 2027, each user gets 150 free DBUs a month across Genie One, Genie Agents and Genie Code, then pays per use. These prices were checked on October 30, 2026.

Metabot, Metabase’s AI assistant, answers questions in natural language, builds query builder charts, writes SQL and answers in Slack. Each question Metabot builds opens in the query builder or the SQL editor, so you can check and change the query behind the answer, and Metabot can only see the data and collections that the person asking has permission to see. It’s on every plan, including open source, when you bring your own key for Anthropic, OpenAI, Amazon Bedrock, Azure OpenAI, Google Gemini Enterprise, Mistral or another provider. Connecting your own AI provider doesn’t require a paid plan, and Metabase adds no markup on your token usage. On Metabase Cloud, the Metabase AI service is an option at $3.75 per million tokens, with 1 million tokens included. Metabase’s MCP server, also on every plan, lets AI clients such as Claude Code and Cursor work with your data, scoped to each person’s Metabase permissions.

When is Databricks AI/BI the natural fit?

Databricks AI/BI is the natural fit when everyone who reads the dashboards already works in your Databricks account, and the data team builds and publishes every dashboard. It suits teams that deploy everything with Declarative Automation Bundles and want dashboards, schedules and jobs in one workspace, with no BI service to run. It also suits teams that plan to use Genie Agents on their Unity Catalog data.

Metabase fits when people outside the data team should explore the same tables and build their own questions in the query builder, without Databricks accounts. It also fits when you embed dashboards for customers with locked parameters on a free edition, or when the people who set up subscriptions should type any email address themselves, without a workspace admin defining notification destinations first. And it fits when you want one BI tool for Databricks and your other databases, on Metabase Cloud or in your own cloud account.

Next steps

• Connect Metabase to Databricks
• Find the Metabase Cloud IP addresses or run Metabase on Docker
• Set collection permissions and data permissions
• Set up row and column security
• Send dashboard subscriptions
• Manage Metabase from the command line and sync your Library with Git
• Create guest embeds with locked parameters
• Set up Metabot and the MCP server
• Compare Metabase plans