Hey @sparkplug — there are a few options, though to be honest, none are super friendly to implement right now. The good news is that we’re actively working on making this easier, and we should see more control in the near future. As of today, though, here’s what’s possible:
Strongest Option
-
Contact Databricks Support and request to “Disable Apps.”
This has to be done by support. It’s the most robust approach and will completely disable Apps in the workspace.
Next Strongest
2. Disable serverless in specific workspaces where Apps shouldn’t be allowed.
In preview-enabled workspaces, turning off serverless from the workspace Previews page disables all serverless products, including Apps.
⚠️ Note: This will also disable other serverless features (Workflows, Notebooks, DLT, etc.).
Most Flexible (but More Admin Work)
3. Restrict who can create, use, and manage Apps via detailed permissions:
-
Limit app creation and management to trusted users or admin groups.
-
Remove CAN USE, CAN MANAGE, or IS OWNER permissions from general users and assign only to admins or service principals.
-
Use group-based permissions or service principals for easier management and to prevent individual users from deploying Apps unchecked.
-
Regularly audit permissions to ensure unauthorized users don’t gain access.
Hope this helps,
— Louis