Role-based access control (RBAC) limitations

Some Azure Databricks features have limited functionality or return errors when you use them as an RBAC role. Check the feature limitations on this page before using a role for your workload.

For method-specific limitations when using dedicated compute assigned to a group, see Known limitations.

For how identity-related SQL functions (session_user(), is_member, is_account_group_member) behave when assuming a role, see How identity functions behave when assuming a role.

Unsupported and partially supported features

The following features either do not work or behave differently when acting as a role:

• Agent Bricks: creating agents as a role is not supported.
• Alerts: managing alerts as a role is not supported.
• Databricks Apps: Connecting to an app works. An app can authorize as its own service principal or, when a user connects, as a role that user has permission to assume. An app's service principal cannot assume a role for programmatic (machine-to-machine) data access.
• Lineage: the system.access.table_lineage.created_by column is correctly populated with the role, but the user who assumed the role is not captured.
• Serverless usage policies: When acting as a role, the workspaces drop-down menu in the serverless usage policy creation form is empty, so you can't scope a policy to specific workspaces. As a workaround, create the policy as your user identity.
• AI Search: managing AI Search endpoints as a role is supported, but creating indexes as a role fails. As a workaround, create the index as a user and then change the owner to a role. Querying AI Search endpoints and indexes as a role is captured correctly in audit events.

Identity and group management

• The workspace-local System for Cross-domain Identity Management (SCIM) API (/api/2.0/preview/scim/v2/) cannot create account groups or modify their membership. Groups created through this API are workspace-local and cannot be used as roles. To create account groups or manage their membership, use the Account Groups API, either through the workspace endpoint (/api/2.0/account/scim/v2/) or directly through the account endpoint (/api/2.1/accounts/{account-id}/scim/v2/).
• Workspace asset sharing controls can be applied to a maximum of 100 groups by default. Additionally, system groups, such as account users and admins, cannot be restricted with workspace asset sharing controls. See Limits and constraints.