Monitor workspace admin activities

[antonionuzzo]

Hello everyone,

I am conducting tests on Databricks AWS and have noticed that in an organization with multiple workspaces, each with different workspace admins, a workspace admin can invite a user who is not mapped within their workspace but is already mapped inside databricks metastore. I would like to understand if it is possible to prohibit this action for the workspace admin or, alternatively, where this information is logged. I believe it is within the system audit access table, but I am unable to find the row that identifies this action.

[SP_6721]

Hi @antonionuzzo 

There isn’t a way in Databricks to restrict workspace admins from inviting users who aren’t part of their workspace but already exist in the metastore. If you're trying to track this activity, you can use the system.access.audit table (assuming system tables are enabled).

Here's a sample query you can run to check for user additions in a specific workspace:

SELECT
     event_time,
     user_identity.email,
     action_name,
     request_params
FROM
     system.access.audit
WHERE
     action_name = 'addUser'
     AND request_params.workspace_id = 'YOUR_WORKSPACE_ID'
ORDER BY
     event_time DESC;

This should help you to see when users were added and by whom.

[antonionuzzo]

Thank you very much for the response. I tried to grant the user access directly, and they are able to access the workspace (workspace enabled with Unity Catalog and system tables enabled). Then I executed the query you recommended, but it returns empty.

[BigRoux]

You do have some control over what workspace admins can do. Databricks allows account admins to restrict workspace admin permissions by enabling the RestrictWorkspaceAdmins setting. Have a look here: https://docs.databricks.com/aws/en/admin/workspace-settings/restrict-workspace-admins

Account admins are elevated and have entitlements at the Databricks Account level. There will only be one or two of these people. Hope this helps.  Louis.