Workflow (Job) Cluster Permission Management

[VJ3]

Hello Team,

I understand that as the Job Owner, they can grant additional permissions to other users to manage/run/view the job.

• If "Can Manage" permission is given to the other users, that user can Edit the job including the Run-As parameter to themselves.
• If "Can Manage Run" permission is given to the other users, then that user cannot edit the job, but can run/cancel/view jobs execution. 
• If "Can View" permission is given to other users, then that use can view the job logs and cannot run/cancel execution.

I have a questions about below: 

In case primary user grant "Can Manage"/ "Run" Permission on the job they own to secondary user

Do we know if "Can Manage" Permission on Job of Cluster will run the job as primary user even incase it is run by Secondary user?

Do we know if "Run" Permission on Job of Cluster will run the job as primary user even incase it is run by Secondary user?

Thank you

I

[Kaniz · Accepted solution]

Hi @VJ3, Let’s delve into the permissions and behaviour of jobs in Databricks when it comes to managing and running them.

1. “Can Manage” Permission:

   • When a secondary user is granted the “Can Manage” permission on a job owned by the primary user, they gain the ability to:
     • View job details and settings.
     • View results of job runs.
     • View Spark UI and logs for job runs.
     • Run the job.
     • Cancel a running job.
     • Edit job settings (including the Run-As parameter).
     • Delete the job.
     • Modify permissions for other users.
   • However, the crucial point here is that the job will always run as the primary user, regardless of w...¹.
   • So, even if the secondary user triggers the job execution, it will execute with the primary user’s identity.

2. “Run” Permission:

   • When a secondary user is granted the “Run” permission on a job owned by the primary user, they can:
     • View job details and settings.
     • View results of job runs.
     • View Spark UI and logs for job runs.
     • Run the job.
     • Cancel a running job.
   • Similar to the “Can Manage” permission, the job will always run as the primary user, regardless of w...¹.
   • Therefore, even if the secondary user triggers the job, it will execute using the primary user’s credentials.

In summary, both “Can Manage” and “Run” permissions do not alter the behaviour of job execution—they always run as the primary user, even if initiated by a secondary user.

Feel free to ask if you have any more questions! 😊