topic Re: No Explicit Deny for User security configurations at the group level? in Data Engineering

No Explicit Deny for User security configurations at the group level?

Chris_Shehu — Wed, 22 Mar 2023 22:20:27 GMT

Currently when you add new users to the Databricks workspace they get added to a "Users" group that has full access to the workspace. There should be a way to use group security to explicitly deny access to those same settings. This setting should override the default allow access.

I also noticed the Parent User Groups are empty inside the groups? Is this maybe something we should be using that we're not?

Re: No Explicit Deny for User security configurations at the group level?

Anonymous — Fri, 24 Mar 2023 17:35:59 GMT

@Christopher Shehu If you don't want the "Users" group is enabled with "Workspace access" and "Databricks SQL access" entitlements, you disable all entitlements. Create separate groups based on your use case and enable the required entitlements.

Regarding parent user groups, a group can be a member(child) of another group(s). As per the screenshot, subgroup is a child of john_test_group and maingroup (parent groups). Hope this helps.

Re: No Explicit Deny for User security configurations at the group level?

Anonymous — Mon, 27 Mar 2023 05:01:20 GMT

Hi @Christopher Shehu

Thank you for posting your question in our community! We are happy to assist you.

To help us provide you with the most accurate information, could you please take a moment to review the responses and select the one that best answers your question?

This will also help other community members who may have similar questions in the future. Thank you for your participation and let us know if you need any further assistance!

Re: No Explicit Deny for User security configurations at the group level?

deanjames — Tue, 28 Mar 2023 08:10:34 GMT

Yes, there should be a way to use group security to explicitly deny access to the workspace settings for new users added to the "Users" group. This setting should override the default allow access. UMR Provider Portal Login

Re: No Explicit Deny for User security configurations at the group level?

Anonymous — Tue, 28 Mar 2023 10:14:06 GMT

@dean james I am not sure about your case why you want to deny access to the group once you create it. Anyhow, we can use deacticate/activate an user using "2.0/preview/scim/v2/Users/{id}" rest API endpoint. We can also deactivate users that have not logged in for a customizable period. Hope this helps

https://docs.databricks.com/dev-tools/api/latest/scim/scim-users.html#activate-and-deactivate-user-by-id

https://docs.databricks.com/dev-tools/api/latest/scim/scim-users.html#automatically-deactivate-users