Hi @antonionuzzo 

There isn’t a way in Databricks to restrict workspace admins from inviting users who aren’t part of their workspace but already exist in the metastore. If you're trying to track this activity, you can use the system.access.audit table (assuming system tables are enabled).

Here's a sample query you can run to check for user additions in a specific workspace:

SELECT
     event_time,
     user_identity.email,
     action_name,
     request_params
FROM
     system.access.audit
WHERE
     action_name = 'addUser'
     AND request_params.workspace_id = 'YOUR_WORKSPACE_ID'
ORDER BY
     event_time DESC;

This should help you to see when users were added and by whom.

Thank you very much for the response. I tried to grant the user access directly, and they are able to access the workspace (workspace enabled with Unity Catalog and system tables enabled). Then I executed the query you recommended, but it returns empty.

You do have some control over what workspace admins can do. Databricks allows account admins to restrict workspace admin permissions by enabling the RestrictWorkspaceAdmins setting. Have a look here: https://docs.databricks.com/aws/en/admin/workspace-settings/restrict-workspace-admins

Account admins are elevated and have entitlements at the Databricks Account level. There will only be one or two of these people. Hope this helps.  Louis.