I need a switch to turn off Data Apps in databricks workspaces

[sparkplug]

Hi

How do I disable Data Apps on my workspace. This is really annoying that Databricks pushes new features without any option to disable them. At least you should have some tools to control access before rolling it out. It seems you only care about features that you think are worthy of disabling like Lakebase. As an admin I feel helpless that the users in my workspace can deploy an app and leave it running for weeks without anyone noticing anything. 

I know I can setup monitoring and alerts but I didn't want to have this problem in the first place.

[sparkplug]

And this website has really become sluggish, or is it just me

[Louis_Frolio · Accepted solution]

Hey @sparkplug — there are a few options, though to be honest, none are super friendly to implement right now. The good news is that we’re actively working on making this easier, and we should see more control in the near future. As of today, though, here’s what’s possible:

Strongest Option

1. Contact Databricks Support and request to “Disable Apps.”

   This has to be done by support. It’s the most robust approach and will completely disable Apps in the workspace.

Next Strongest

2. Disable serverless in specific workspaces where Apps shouldn’t be allowed.

In preview-enabled workspaces, turning off serverless from the workspace Previews page disables all serverless products, including Apps.

⚠️ Note: This will also disable other serverless features (Workflows, Notebooks, DLT, etc.).

Most Flexible (but More Admin Work)

3. Restrict who can create, use, and manage Apps via detailed permissions:

• Limit app creation and management to trusted users or admin groups.

• Remove CAN USE, CAN MANAGE, or IS OWNER permissions from general users and assign only to admins or service principals.

• Use group-based permissions or service principals for easier management and to prevent individual users from deploying Apps unchecked.

• Regularly audit permissions to ensure unauthorized users don’t gain access.

Hope this helps,

— Louis

[SimonV]

Wanted to second this request, not great that users can just do this without the people administrating the system being able to control it.

@Louis_Frolio regarding your third suggestion:

> Limit app creation and management to trusted users or admin groups.

How and where can one do this?

> Remove CAN USE, CAN MANAGE, or IS OWNER permissions from general users and assign only to admins or service principals.

To which resource should this apply? There are no Apps listed in the ACL documentation https://docs.databricks.com/aws/en/security/auth/access-control/

Thanks

[Louis_Frolio]

Regular users can’t perform this action — only admins or the owner of the object can. Databricks follows the principle of least privilege, so access is always scoped to the minimum required.

Hope this helps, Louis

[SimonV]

Hi @Louis_Frolio , Thanks for the quick reply

I'm sorry, but I don't understand. I am account admin and want to limit who can create apps via the third option you mentioned. How and where can one actually "Restrict who can create, use, and manage Apps via detailed permissions"?
Our regular users can definitely create apps even though they are not admins nor owner of the workspace.

Thanks,
Simon

[sparkplug]

Hi @Louis_Frolio Thanks for your reply. I have checked the previews regularly but never found an option on workspace level to disable server less. See screenshot for how it looks for me.

I can reach out to the account team if that's the best option. 

[Louis_Frolio]

@sparkplug , it cannot be turned off as a workspace administrator, you have to be a Databricks Account Administrator. The switch is at the account console, not in the workspace.

Hope this helps, Louis.

[sparkplug]

Okay, this I already knew, but wanted more control on workspace level.

[Louis_Frolio]

It is presently not an option at the Workspace level.  

Regards, Louis.

[Raman_Unifeye]

Thanks @Louis_Frolio for the options. As you mentioned none of the options are straighforward ones, is it something can be added to product roadmap ?

[Louis_Frolio]

@Raman_Unifeye , I don't have visibility into the roadmap. However, if you are a customer you can always log a feature request. Cheers, Louis.

[Raman_Unifeye]

Sure, I will be logging this request. Thanks.