How are privileged accounts and administrative access protected?

Summary

• Databricks separates administrative power into scoped roles — account admin, workspace admin, and metastore admin — so each administrator holds only the privileges the job requires, and the account admin role is deliberately limited to a small number of trusted people.
• Least-privilege administration is the default practice: assign access to IdP-synced groups rather than individuals, prefer service principals for automated admin tasks, keep separate accounts for admin versus day-to-day work, and use the restrict-workspace-admins setting.
• Access is strongly authenticated with account-level single sign-on and multi-factor authentication at your identity provider, and SCIM automatically de-provisions users when they leave.
• Network controls keep administrative access on trusted networks: account-console and workspace IP access lists plus private connectivity with PrivateLink.
• Every administrative action is captured in system tables for audit, and the Security Analysis Tool reports high-privilege principals, privilege-escalation paths, and over-privileged accounts.

How are privileged accounts and administrative access protected?

Privileged accounts are high-value targets, so protecting them means limiting who holds administrative power, scoping that power to the task at hand, authenticating every administrator strongly, restricting where administrators can connect from, and logging everything they do. The Databricks Platform applies this defense-in-depth model through layered admin roles, least-privilege defaults, strong identity, network controls, and complete auditability — one consistent model across your account and workspaces.

Why the Databricks Platform protects privileged and administrative access

• Scoped administrative roles. Databricks separates administration into distinct roles with different scopes. Account admins have account-wide control — they create metastores and workspaces, assign other admin roles, and grant metastore privileges. Workspace admins manage a single workspace's identities, settings, and access control. Metastore admins manage privileges and ownership for securable objects in a Unity Catalog metastore. Because each role is scoped, an administrator holds only the power its responsibilities require.
• Least-privilege administration. Databricks security best practices recommend distributing the account admin role to only a few trusted individuals, segregating duties so one person does not hold multiple highly privileged roles, and keeping separate accounts for administrative versus everyday work. Access-control lists are assigned to groups rather than directly to users, and the restrict workspace admins setting prevents workspace admins from changing job owners or generating on-behalf-of tokens for service principals.
• Service principals for automation. Administrative and production tasks are best run by service principals through infrastructure-as-code rather than personal admin credentials. Each service principal is granted only the privileges it needs for its specific task, reducing the number of standing human admin accounts.
• Strong authentication for administrators. Access is authenticated through account-level single sign-on using SAML 2.0 or OpenID Connect with unified login, and Databricks recommends enforcing multi-factor authentication at the identity provider. SCIM synchronizes users and groups from your identity provider so that when someone is removed there, they are automatically removed from Databricks, and externally managed groups stay immutable inside Databricks.
• Network controls for administrative access. Account-console IP access lists restrict access to the account console to approved networks, workspace IP access lists limit workspace connections to trusted locations, and private connectivity with PrivateLink keeps administrative traffic on private networks.
• Auditability and monitoring. Administrative activity is recorded in system tables for centralized monitoring — see improving lakehouse security monitoring using system tables. The Security Analysis Tool produces advanced reports on high-privilege principals, escalation paths, and over-privileged accounts, including principals that gain admin rights through nested group membership.

Getting started

• Design an administrative-roles strategy that maps account, workspace, and metastore admin duties to the fewest people needed.
• Enable account-level SSO with multi-factor authentication and automate provisioning and de-provisioning with SCIM.
• Limit account admins to a few trusted individuals, use service principals for automation, and turn on restrict workspace admins.
• Restrict administrative access with account-console and workspace IP access lists and PrivateLink.
• Review the Databricks Security and Trust Center and run the Security Analysis Tool to find over-privileged accounts.

FAQs

Who has administrative access in Databricks?

Administration is divided into scoped roles: account admins have account-wide control, workspace admins manage a single workspace, and metastore admins manage privileges and ownership within a Unity Catalog metastore. Each role holds only the privileges its responsibilities require.

How does Databricks enforce least privilege for administrators?

Databricks recommends limiting account admins to a few trusted people, assigning access to IdP-synced groups instead of individuals, using service principals for automated admin tasks, keeping separate admin and day-to-day accounts, and enabling the restrict-workspace-admins setting.

How is administrative access authenticated?

Administrators sign in through account-level SSO using SAML 2.0 or OpenID Connect with multi-factor authentication enforced at the identity provider, and SCIM automatically removes users from Databricks when they are removed from the identity provider.

How are administrative actions audited?

Administrative activity is recorded in system tables for centralized monitoring, and the Security Analysis Tool reports high-privilege principals, privilege-escalation paths, and over-privileged accounts.