Hey @sparkplug โ there are a few options, though to be honest, none are super friendly to implement right now. The good news is that weโre actively working on making this easier, and we should see more control in the near future. As of today, though, hereโs whatโs possible:
Strongest Option
-
Contact Databricks Support and request to โDisable Apps.โ
This has to be done by support. Itโs the most robust approach and will completely disable Apps in the workspace.
Next Strongest
2. Disable serverless in specific workspaces where Apps shouldnโt be allowed.
In preview-enabled workspaces, turning off serverless from the workspace Previews page disables all serverless products, including Apps.
โ ๏ธ Note: This will also disable other serverless features (Workflows, Notebooks, DLT, etc.).
Most Flexible (but More Admin Work)
3. Restrict who can create, use, and manage Apps via detailed permissions:
-
Limit app creation and management to trusted users or admin groups.
-
Remove CAN USE, CAN MANAGE, or IS OWNER permissions from general users and assign only to admins or service principals.
-
Use group-based permissions or service principals for easier management and to prevent individual users from deploying Apps unchecked.
-
Regularly audit permissions to ensure unauthorized users donโt gain access.
Hope this helps,
โ Louis