Workspace asset sharing controls

Preview

This feature is in Public Preview.

When users assume a role, they can create workspace assets (notebooks, SQL queries, SQL warehouses, jobs) that the role owns. By default, the role can share those assets with other workspace users. Without additional controls, a user acting as a role with access to sensitive data can build a dashboard on that data and share it with users who lack access.

To prevent this, Databricks provides a workspace-level setting that restricts specific groups (typically those used as roles for exclusive access) from sharing workspace assets they own.

Requirements

You must be a workspace administrator to configure workspace asset sharing controls.

How the restriction applies

The restriction applies only when a user or Databricks service principal is acting as a listed group (that is, has assumed it as a role). This includes acting as the listed group directly or as a member of a group nested under a listed group. When acting as their user identity, users and service principals can still share workspace assets they own or can manage, even if they are members of a listed group.

This scope is intentional. It lets admins create isolation boundaries around roles used for exclusive access without curtailing day-to-day collaboration for users acting as their user identity.

• A user acting as their user identity can share any workspace asset they own or can manage, even if they are a member of a listed group.
• A user acting as a listed group cannot share workspace assets owned by that group, even with Can Manage permission on the asset.
• A user acting as a group nested under a listed group is also restricted. For example, if the list contains clinical-trial-1, and clinical-trial-1-analysts is nested under it, users acting as clinical-trial-1-analysts are also restricted.

Configure sharing controls

To restrict a group from sharing workspace assets it owns:

1. In the Databricks workspace, click your username in the upper right and select Settings.
2. Click the Advanced tab.
3. Find Restrict sharing for groups.
4. Click the edit button.
5. Browse, search for, and select the groups you want to restrict.
6. Click Save.

Verify the restriction

To verify that the restriction is working:

1. Assume a restricted role using any of the supported methods. See Switch roles.
2. Open or create a workspace asset owned by the role (for example, a notebook).
3. Attempt to share the asset.

The share option is unavailable for assets owned by restricted roles.

Next steps

• Model exclusive access: Apply patterns for setting up exclusive access with either an account-local group or a group synced from your identity provider. See Model exclusive access.
• Switch roles: Assume a role using the role switcher, dedicated access mode clusters, the CLI, the API, or third-party BI tools. See Switch roles.
• Review limitations: Understand which Databricks features are not supported or only partially supported when acting as a role. See Role-based access control (RBAC) limitations.