Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This page describes details about the permissions available for the different workspace objects.
Access control lists overview
In Azure Databricks, you can use access control lists (ACLs) to configure permission to access workspace level objects. Workspace admins have the CAN MANAGE permission on all objects in their workspace, which gives them the ability to manage permissions on all objects in their workspaces. Users automatically have the CAN MANAGE permission for objects that they create.
For an example of how to map typical personas to workspace-level permissions, see the Proposal for Getting Started With Databricks Groups and Permissions.
Manage access control lists with folders
You can manage workspace object permissions by adding objects to folders. Objects in a folder inherit all permissions settings of that folder. For example, a user that has the CAN RUN permission on a folder has CAN RUN permission on the alerts in that folder.
If you grant a user access to an object inside the folder, they can view the parent folder's name, even if they do not have permissions on the parent folder. For example, a notebook named test1.py is in a folder named Workflows. If you grant a user CAN VIEW on test1.py and no permissions on Workflows, the user can see that the parent folder is named Workflows. The user cannot view or access any other objects in the Workflows folder unless they have been granted permissions on them.
To learn about organizing objects into folders, see Workspace browser.
Note
In an upcoming release, account group membership also affects workspace object permissions. Members inherit permissions on workspace objects, such as jobs, notebooks, and folders, from all account groups of which they are a member, regardless of whether those groups are assigned to the workspace. Use the Orphaned permissions analysis notebook to review permission grants in your workspaces. See Workspace object permissions will soon be inherited from all account groups.
Alerts ACLs
| Ability | NO PERMISSIONS | CAN RUN | CAN MANAGE |
|---|---|---|---|
| See in alert list | โ | โ | |
| View alert and result | โ | โ | |
| Manually trigger alert run | โ | โ | |
| Subscribe to notifications | โ | โ | |
| Edit alert | โ | ||
| Modify permissions | โ | ||
| Delete alert | โ |
Compute ACLs
Important
On compute resources that use the legacy access mode No isolation shared, users with CAN ATTACH TO permissions can view the service account keys in the log4j file. Use caution when granting this permission. For more detail on this mode and how to restrict it, see What are no isolation shared clusters?.
| Ability | NO PERMISSIONS | CAN ATTACH TO | CAN RESTART | CAN MANAGE |
|---|---|---|---|---|
| Attach notebook to compute | โ | โ | โ | |
| View Spark UI | โ | โ | โ | |
| View compute metrics | โ | โ | โ | |
| Terminate compute | โ | โ | ||
| Start and restart compute | โ | โ | ||
| View driver logs | โ (see note) | |||
| Edit compute | โ | |||
| Attach library to compute | โ | |||
| Resize compute | โ | |||
| Modify permissions | โ |
Note
Secrets are not redacted from the classic compute resource's Spark driver's stdout and stderr streams. To protect sensitive data, by default, Spark driver logs are viewable only by users with CAN MANAGE permission on job compute and all-purpose compute on dedicated or standard access mode. The same default applies to compute resources created from a pool. To allow users with CAN ATTACH TO or CAN RESTART permission to view the logs, set the following property in the compute's Spark config field: spark.databricks.acl.needAdminPermissionToViewLogs false.
On legacy compute with No isolation shared access mode, the Spark driver logs can be viewed by users with CAN ATTACH TO, CAN RESTART, or CAN MANAGE permission. To limit who can read the logs to only users with the CAN MANAGE permission, set spark.databricks.acl.needAdminPermissionToViewLogs to true.
Because spark.databricks.acl.needAdminPermissionToViewLogs is a compute-level Spark property, you must set it on each compute that needs it. For ephemeral job runs submitted via jobs/runs/submit, such as those triggered by an external orchestrator, set the property in new_cluster.spark_conf at submission time, along with any access_control_list entries.
Dashboard ACLs
| Ability | NO PERMISSIONS | CAN VIEW/CAN READ* | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| View dashboard, results, and datasets | โ | โ | โ | โ | |
| Interact with widgets | โ | โ | โ | โ | |
| Refresh the dashboard | โ | โ | โ | โ | |
| Edit dashboard | โ | โ | |||
| Clone dashboard | โ | โ | โ | โ | |
| Publish dashboard snapshot | โ | โ | |||
| Modify permissions | โ | ||||
| Delete dashboard | โ |
* The workspace UI refers to view-only access as CAN VIEW, while the Permissions API uses CAN READ to represent the same level of access.
Database instance ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| Get database instance | โ | โ | โ | |
| List database instances | โ | โ | โ | |
| Create database instance | โ | โ | โ | |
| Create synced table | โ | โ | ||
| Create Unity Catalog database catalog | โ | |||
| Modify Postgres roles | โ | |||
| Delete database instance | โ | |||
| Modify permissions | โ | |||
| Pause database instance | โ | |||
| Resume database instance | โ |
Note
- All workspace users automatically inherit CAN CREATE permission. This permission cannot be assigned or removed.
- When performing operations that interact with Unity Catalog you need to have permissions on the Unity Catalog object:
- Create Unity Catalog database catalog: Requires the
CREATE CATALOGprivilege on the Unity Catalog metastore. - Create synced table: Requires Unity Catalog permissions to read the source table, write to the destination schema, and write to the pipeline storage schema.
- Create Unity Catalog database catalog: Requires the
Lakebase project ACLs
These ACL tables show permissions for Lakebase (Autoscaling) projects.
For Lakebase (Provisioned) permissions, see Database instance ACLs.
Note
- Workspace admins automatically inherit the CAN MANAGE permission on all Lakebase project resources.
- All workspace users automatically inherit the CAN CREATE permission. This permission cannot be assigned or removed.
- To grant access to other individuals, groups, or service principals, assign the CAN MANAGE or CAN USE permission.
Project ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| View project | โ | โ | โ | |
| Create project | โ | โ | โ | |
| Delete project | โ | |||
| Update project | โ | |||
| View connection URI | โ | โ | ||
| List projects | โ | โ | โ | |
| View project limits | โ | โ | โ |
Branch ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| List project branches | โ | โ | โ | |
| Create project branch | โ | |||
| Count project branches | โ | โ | โ | |
| Create branch database | โ | โ | ||
| Create branch role | โ | โ | ||
| Delete project branch | โ | |||
| Delete branch database | โ | โ | ||
| Delete branch role | โ | โ | ||
| Delete project branches | โ | |||
| Finalize restore branch | โ | |||
| View project branch | โ | โ | โ | |
| View branch database | โ | โ | โ | |
| View branch role | โ | โ | โ | |
| View branch role password | โ | โ | ||
| View branch schema | โ | โ | โ | |
| List branch databases | โ | โ | โ | |
| List branch endpoints | โ | โ | โ | |
| List branch roles | โ | โ | โ | |
| Reset project branch | โ | |||
| Reset branch role password | โ | โ | ||
| Reset branch to parent | โ | |||
| Restore project branch | โ | |||
| Set default project branch | โ | |||
| Update project branch | โ | |||
| Update branch database | โ | โ |
Snapshot ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| List snapshots | โ | โ | โ | |
| Create snapshot | โ | โ | ||
| View snapshot schedule | โ | โ | โ | |
| Set snapshot schedule | โ | โ | ||
| Delete snapshot | โ | |||
| Update snapshot | โ | |||
| Restore snapshot | โ |
Endpoint ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| List project endpoints | โ | โ | โ | |
| Create project endpoint | โ | |||
| Delete project endpoint | โ | |||
| View project endpoint | โ | โ | โ | |
| Restart project endpoint | โ | |||
| Start project endpoint | โ | |||
| Suspend project endpoint | โ | |||
| Update project endpoint | โ |
Operation ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| View project operations | โ | โ | โ | |
| List project operations | โ | โ | โ | |
| List running project operations | โ | โ | โ |
Lakeflow pipelines ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN RUN | CAN MANAGE | IS OWNER |
|---|---|---|---|---|---|
| View pipeline details and list pipeline | โ | โ | โ | โ | |
| View Spark UI and driver logs | โ | โ | โ | โ | |
| Start and stop a pipeline update | โ | โ | โ | ||
| Stop pipeline clusters directly | โ | โ | โ | ||
| Edit pipeline settings | โ | โ | |||
| Delete the pipeline | โ | โ | |||
| Purge runs and experiments | โ | โ | |||
| Modify permissions | โ | โ |
Feature tables ACLs
This table describes how to control access to feature tables in workspaces that are not enabled for Unity Catalog. If your workspace is enabled for Unity Catalog, use Unity Catalog privileges instead.
Note
- Feature Store access control does not govern access to the underlying Delta table, which is governed by table access control.
- For more information about workspace feature table permissions, see Access control (legacy).
| Ability | CAN VIEW METADATA | CAN EDIT METADATA | CAN MANAGE |
|---|---|---|---|
| Read feature table | โ | โ | โ |
| Search feature table | โ | โ | โ |
| Publish feature table to online store | โ | โ | โ |
| Write features to feature table | โ | โ | |
| Update description of feature table | โ | โ | |
| Modify permissions | โ | ||
| Delete feature table | โ |
File ACLs
| Ability | NO PERMISSIONS | CAN VIEW* | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| Read file | โ | โ | โ | โ | |
| Comment | โ | โ | โ | โ | |
| Attach and detach file | โ | โ | โ | ||
| Run file interactively | โ | โ | โ | ||
| Edit file | โ | โ | |||
| Modify permissions | โ |
* The workspace UI refers to view-only access as CAN VIEW, while the Permissions API uses CAN READ to represent the same level of access.
Folder ACLs
| Ability | NO PERMISSIONS | CAN VIEW* | CAN EDIT | CAN RUN | CAN MANAGE |
|---|---|---|---|---|---|
| List objects in folder | โ | โ | โ | โ | โ |
| View objects in folder | โ | โ | โ | โ | |
| Clone and export items | โ | โ | โ | ||
| Run objects in the folder | โ | โ | |||
| Create, import, and delete items | โ | ||||
| Move and rename items | โ | ||||
| Modify permissions | โ |
* The workspace UI refers to view-only access as CAN VIEW, while the Permissions API uses CAN READ to represent the same level of access.
Genie Code chat ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN MANAGE |
|---|---|---|---|
| View chat thread | โ | โ | |
| Add new prompts and edit the chat thread | โ | ||
| Make a copy of the chat thread | โ | ||
| Rename the chat thread | โ | ||
| Delete the chat thread | โ | ||
| Modify permissions | โ |
Genie Agent ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| See in Genie Agent list | โ | โ | โ | โ | |
| Ask questions in the Genie Agent | โ | โ | โ | โ | |
| Provide response feedback | โ | โ | โ | โ | |
| Add or edit instructions | โ | โ | |||
| Add or edit sample questions | โ | โ | |||
| Add or remove included tables | โ | โ | |||
| Monitor a space | โ | ||||
| Modify permissions | โ | ||||
| Delete space | โ | ||||
| View other users' conversations | โ |
Note
For a Genie Agent, CAN VIEW and CAN RUN grant the same abilities.
Git folder ACLs
| Ability | NO PERMISSIONS | CAN READ | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| List assets in a folder | โ | โ | โ | โ | โ |
| View assets in a folder | โ | โ | โ | โ | |
| Clone and export assets | โ | โ | โ | โ | |
| Run executable assets in folder | โ | โ | โ | ||
| Edit and rename assets in a folder | โ | โ | |||
| Create a branch in a folder | โ | ||||
| Switch branches in a folder | โ | ||||
| Pull or push a branch into a folder | โ | ||||
| Create, import, delete, and move assets | โ | ||||
| Modify permissions | โ |
Job ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN MANAGE RUN | IS OWNER | CAN MANAGE |
|---|---|---|---|---|---|
| View job details and settings | โ | โ | โ | โ | |
| View results | โ | โ | โ | โ | |
| View Spark UI, logs of a job run | โ | โ | โ | ||
| Run now | โ | โ | โ | ||
| Run now with different parameters | โ | โ | โ | ||
| Cancel run | โ | โ | โ | ||
| Edit job settings | โ | โ | |||
| Delete job | โ | โ | |||
| Modify permissions | โ | โ |
Note
- The creator of a job has the IS OWNER permission by default.
- A job cannot have more than one owner.
- A group cannot be assigned the Is Owner permission as an owner.
- Jobs triggered through Run Now assume the permissions of the job owner and not the user who issued Run Now.
- Jobs access control applies to jobs displayed in the Lakeflow Jobs UI and their runs. It doesn't apply to:
Notebook workflows that run modular or linked code. These use the permissions of the notebook itself. If the notebook comes from Git, a new copy is created and its files inherit the permissions of the user who triggered the run.
Jobs submitted by API. These use the notebook's default permissions unless you explicitly set the
access_control_listin the API request.
MLflow experiment ACLs
MLflow experiment ACLs are different for notebook experiments and workspace experiments. Notebook experiments cannot be managed independently of the notebook that created them, so the permissions are similar to notebook permissions.
To learn more about the two types of experiments, see Organize training runs with MLflow experiments.
ACLs for notebook experiments
Changing these permissions also modifies the permissions on the notebook that corresponds to the experiment.
| Ability | NO PERMISSIONS | CAN READ | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| View notebook | โ | โ | โ | โ | |
| Comment on notebook | โ | โ | โ | โ | |
| Attach/detach notebook to compute | โ | โ | โ | ||
| Run commands in the notebook | โ | โ | โ | ||
| Edit notebook | โ | โ | |||
| Modify permissions | โ |
ACLs for workspace experiments
| Ability | NO PERMISSIONS | CAN READ | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|
| View experiment | โ | โ | โ | |
| Log runs to the experiment | โ | โ | ||
| Edit the experiment | โ | โ | ||
| Delete the experiment | โ | |||
| Modify permissions | โ |
MLflow model ACLs
This table describes how to control access to registered models in workspaces that are not enabled for Unity Catalog. If your workspace is enabled for Unity Catalog, use Unity Catalog privileges instead.
| Ability | NO PERMISSIONS | CAN READ | CAN EDIT | CAN MANAGE STAGING VERSIONS | CAN MANAGE PRODUCTION VERSIONS | CAN MANAGE |
|---|---|---|---|---|---|---|
| View model details, versions, stage transition requests, activities, and artifact download URIs | โ | โ | โ | โ | โ | |
| Request a model version stage transition | โ | โ | โ | โ | โ | |
| Add a version to a model | โ | โ | โ | โ | ||
| Update model and version description | โ | โ | โ | โ | ||
| Add or edit tags | โ | โ | โ | โ | ||
| Transition model version between stages | โ | โ | โ | |||
| Approve a transition request | โ | โ | โ | |||
| Cancel a transition request | โ | |||||
| Rename model | โ | |||||
| Modify permissions | โ | |||||
| Delete model and model versions | โ |
Notebook ACLs
| Ability | NO PERMISSIONS | CAN VIEW* | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| View cells | โ | โ | โ | โ | |
| Comment | โ | โ | โ | โ | |
| Run using %run or notebook workflows | โ | โ | โ | โ | |
| Attach and detach notebooks | โ | โ | โ | ||
| Run commands | โ | โ | โ | ||
| Edit cells | โ | โ | |||
| Modify permissions | โ |
* The workspace UI refers to view-only access as CAN VIEW, while the Permissions API uses CAN READ to represent the same level of access.
Pool ACLs
| Ability | NO PERMISSIONS | CAN ATTACH TO | CAN MANAGE |
|---|---|---|---|
| Attach cluster to pool | โ | โ | |
| Delete pool | โ | ||
| Edit pool | โ | ||
| Modify permissions | โ |
Query ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| View own queries | โ | โ | โ | โ | |
| See in query list | โ | โ | โ | โ | |
| View query text | โ | โ | โ | โ | |
| View query result | โ | โ | โ | โ | |
| Refresh query result (or choose different parameters) | โ | โ | โ | ||
| Include the query in a dashboard | โ | โ | โ | ||
| Change SQL warehouse or data source | โ | โ | โ | ||
| Edit query text | โ | โ | |||
| Modify permissions | โ | ||||
| Delete query | โ |
Legacy SQL editor query ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN RUN | CAN EDIT | CAN MANAGE |
|---|---|---|---|---|---|
| View own queries | โ | โ | โ | โ | |
| See in query list | โ | โ | โ | โ | |
| View query text | โ | โ | โ | โ | |
| View query result | โ | โ | โ | โ | |
| Refresh query result (or choose different parameters) | โ | โ | โ | ||
| Include the query in a dashboard | โ | โ | โ | ||
| Edit query text | โ | โ | |||
| Change SQL warehouse or data source | โ | ||||
| Modify permissions | โ | ||||
| Delete query | โ |
Secret ACLs
| Ability | READ | WRITE | MANAGE |
|---|---|---|---|
| Read the secret scope | โ | โ | โ |
| List secrets in the scope | โ | โ | โ |
| Write to the secret scope | โ | โ | |
| Modify permissions | โ |
Serving endpoint ACLs
| Ability | NO PERMISSIONS | CAN VIEW | CAN QUERY | CAN MANAGE |
|---|---|---|---|---|
| Get endpoint | โ | โ | โ | |
| List endpoint | โ | โ | โ | |
| Query endpoint | โ | โ | ||
| Update endpoint config | โ | |||
| Delete endpoint | โ | |||
| Modify permissions | โ |
SQL warehouse ACLs
To create a SQL warehouse, you must be a workspace admin or have unrestricted cluster creation permissions. For details, see Create a SQL warehouse. The following table covers permissions on existing warehouses.
| Ability | NO PERMISSIONS | CAN VIEW | CAN MONITOR | CAN USE | IS OWNER | CAN MANAGE |
|---|---|---|---|---|---|---|
| Start the warehouse | โ | โ | โ | โ | ||
| View warehouse details | โ | โ | โ | โ | โ | |
| View warehouse queries | โ | โ | โ | โ | ||
| Run queries | โ | โ | โ | โ | ||
| View warehouse monitoring tab | โ | โ | โ | โ | ||
| Stop the warehouse | โ | โ | ||||
| Delete the warehouse | โ | โ | ||||
| Edit the warehouse | โ | โ | ||||
| Modify permissions | โ | โ |
AI Search endpoint ACLs
| Ability | NO PERMISSIONS | CAN CREATE | CAN USE | CAN MANAGE |
|---|---|---|---|---|
| Get endpoint | โ | โ | โ | |
| List endpoints | โ | โ | โ | |
| Create endpoint | โ | โ | โ | |
| Use endpoint (create index) | โ | โ | ||
| Delete endpoint | โ | |||
| Modify permissions | โ |
