How do I monitor and secure internal apps in production?

Summary

• Production security for internal apps requires multiple layers: identity verification, network access controls, data encryption, and comprehensive audit logging.
• Databricks Apps inherit workspace security automatically: single sign-on, multi-factor authentication, SCIM auto-provisioning, and IP access lists apply to all apps without extra configuration.
• Unity Catalog enforces fine-grained data governance: row filters, column masks, and attribute-based access control ensure users only access data they're authorized for.
• Monitor app health with workspace audit logs and compute metrics: track who accessed which app, what queries were executed, how long they ran, and what resources were consumed.
• CI/CD pipelines and version control let you test security changes in staging before rolling out to production, with automatic rollback if issues arise.

How do I monitor and secure internal apps in production?
Securing internal apps in production means controlling who can access them, what data they can query, and recording every action for compliance. Databricks Apps run on your Databricks workspace, so they inherit the platform's security and governance model: you don't build security features into each app, you configure them once at the workspace level. Monitoring then becomes a matter of observing workspace audit logs, compute metrics, and data access patterns to detect anomalies or unauthorized activity.

What is production security for internal apps?

Production security for internal apps covers three areas: identity and access (who can run the app), data access control (what the app can query), and observability (logging every access). On Databricks, this is enforced by workspace-level identity controls, Unity Catalog fine-grained permissions, and audit logging. Because apps run in your workspace, not on external infrastructure, security policies are centralized and consistent across all apps.

Key capabilities to evaluate

Capability	Why it matters
Single sign-on and MFA	Apps authenticate through your identity provider (Azure AD, Okta, etc.) with multi-factor authentication. Users don't create separate app passwords.
Automated identity lifecycle	SCIM provisioning and de-provisioning ensures access is revoked when someone leaves, without manual app-by-app updates.
Network isolation	IP access lists and front-end PrivateLink restrict app access to approved networks, preventing access from untrusted locations.
Data governance	Unity Catalog row filters and column masks enforce fine-grained access so users can't query unauthorized data even if the app is compromised.
Audit logging	Every access to the app, every query executed, and every dataset touched is recorded in centralized logs for compliance and incident investigation.
Encryption	Data is encrypted in transit (TLS) and at rest (AES-256); Enterprise-tier customers can add customer-managed keys for additional control.
Role-based access control	Workspace admins, metastore admins, and app developers have scoped roles so no single person has all permissions.
Version control and CI/CD	Apps are defined in YAML and stored in Git, so security changes can be reviewed, tested in staging, and rolled back if necessary.

How Databricks approaches app security

Databricks Apps are secured through the Databricks Platform's built-in controls:
Identity and access. Apps require Databricks workspace login, which enforces your account-level single sign-on policy, multi-factor authentication, and IP restrictions. Users can't access an app without passing these identity checks. SCIM integration with your identity provider ensures that when someone leaves your organization, their workspace access is automatically revoked and the app becomes inaccessible to them.
Data governance. Apps query your lakehouse through Unity Catalog, which enforces row filters and column masks at query time. If your app logic tries to query a table marked sensitive, the query either fails or returns masked values, depending on your policy. Users with insufficient permissions can't bypass these restrictions by using the app.
Audit and logging. Your Databricks workspace generates audit logs for every app access, every query execution, and every metadata change. These logs are stored in your cloud account (AWS S3, Azure ADLS, or GCP Cloud Storage) and can be ingested into your SIEM, data lake, or security analytics platform for ongoing monitoring.
Compute isolation and quotas. Apps run on compute that you control. You can set compute quotas and monitor CPU and memory usage to prevent resource exhaustion.
Network security. IP access lists restrict connections to your organization's networks, front-end PrivateLink enables private connectivity, and egress controls prevent data exfiltration.
Staged deployment and CI/CD. Define your app in a Declarative Automation Bundle (YAML), store it in Git, and deploy to a staging workspace for testing before promoting to production. If a security issue is discovered, rollback is as simple as reverting a commit.

Monitoring apps in production

Track app usage. Query your workspace audit logs for AppAccess events to see who logged into which app, when, and from where. Unusual access patterns (e.g., access from a new geography) can trigger investigation.
Monitor query performance and resource consumption. Use workspace compute metrics to track how many queries the app is running, how long they take, and how much compute they consume. Spike in query duration or resource use may indicate performance problems or inefficient app logic.
Audit data access. Query the Unity Catalog audit logs to see which tables were queried by the app, by which users, and whether any access was denied. Denied access events can indicate either user mistakes or potential privilege escalation attempts.
Set up alerts. Configure alerting rules in your SIEM or log aggregation platform to flag unauthorized access attempts, unusual data access patterns, or compute resource anomalies.

FAQs

Can I encrypt the connection between users and the app?

Yes. All connections to Databricks Apps use TLS 1.2 or later (encrypted in transit). Data at rest is encrypted with AES-256. Enterprise-tier customers can add customer-managed keys to control the encryption key.

What happens if someone tries to access an app they're not authorized for?

The workspace authentication layer rejects the login before the app even loads. Users not in your workspace or organization can't access the app at all. If a user is in the workspace but lacks permissions to run the app, they'll see a permission denied error.

How can I audit who accessed what data through an app?

Workspace audit logs record every query run by the app, which tables were accessed, and which user triggered the query. Unity Catalog audit logs show whether the user was authorized to access the table and whether any row filters or column masks were applied. Export these logs to your SIEM for long-term retention and analysis.