Restrict workspace admins
By default, workspace admins can change a job owner to any user or service principal in their workspace. Workspace admins can change the job run as setting to service principals they have the Service Principal User role on or to any user in their workspace.
Account admins can configure a workspace setting called RestrictWorkspaceAdmins
to restrict workspace admins to only change a job owner to themselves and the job run as setting to a service principal that they have the Service Principal User role on.
To enable the RestrictWorkspaceAdmins
setting, you must be an account admin and you must be a member of the workspace that you want to restrict. The following example uses the Databricks CLI v0.215.0.
The RestrictWorkspaceAdmins
setting uses an etag
field to ensure consistency. To enable or disable the setting, first issue a GET
to receive an etag
in response. You can update the setting using the etag
. For example:
databricks settings restrict-workspace-admins get
Example response:
{
"etag":"<etag>",
"restrict_workspace_admins": {
"status":"ALLOW_ALL"
},
"setting_name":"default"
}
Copy the etag
field from the response body and use it to update the RestrictWorkspaceAdmins
setting. For example:
databricks settings restrict-workspace-admins update --json '{
"setting": {
"setting_name": "default",
"restrict_workspace_admins": {
"status": "RESTRICT_TOKENS_AND_JOB_RUN_AS"
},
"etag": "<etag>"
},
"allow_missing": true,
"field_mask": "restrict_workspace_admins.status"
}'
Example response:
{
"etag":"<response-etag>",
"restrict_workspace_admins": {
"status":"RESTRICT_TOKENS_AND_JOB_RUN_AS"
},
"setting_name":"default"
}
To disable the RestrictWorkspaceAdmins
set the status to ALLOW_ALL
.
You can also use the Restrict Workspace Admins API or the Databricks Terraform provider.