Too many teams set up Databricks permissions once and forget them. Six months later, roles drift, projects change, and datasets that should be locked down are wide open. A quarterly check-in on Databricks access control can close these gaps before they turn into incidents.
Start With an Inventory
Begin by listing all user accounts, service principals, and groups with Databricks workspace access. Pull this data directly from your identity provider or the Databricks admin console. Compare it to your organization’s current team structure. Remove or disable accounts for users who have moved teams or left the company.
Audit Permissions at Every Layer
Databricks access control applies at the workspace, cluster, table, and even notebook level. Review each permission layer. Check who can launch high-cost clusters, who can run jobs on production data, and who has write access to critical tables. Enforce least privilege: no one should have more access than they need.
Validate Group Memberships
Groups in Databricks often map to projects or roles. Over time, people get added but not removed. Keeping these clean is critical. Every quarterly check-in should include verifying that group membership matches the current scope of responsibilities.