Hi koti521,

When you say vendor I'm assuming you mean Databricks, or is there other vendors you have in mind. Thoughts below.

1. Customer-controlled changes (configs, policies, permissions) are made by your admins, service principals, or automation, and are traceable in audit logs. Query system.access.audit for who/when/what/source IP. Some events (notebook, command-level) need verbose audit logging enabled.

• Audit log system table: https://learn.microsoft.com/azure/databricks/admin/system-tables/audit-logs
• Verbose audit logs: https://learn.microsoft.com/azure/databricks/admin/account-settings/verbose-logs
• Azure resource-plane operations (networking, storage, Key Vault): use Azure Activity Logs — https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log

2. Platform-side updates (GA features, backend changes) are applied by the managed service and are mostly not customer-deferrable. The lever you control is automatic cluster update timing via maintenance windows. For a specific update, Databricks Support can confirm what's configurable or monitored.

Controlling what runs in production — two distinct controls:

• Previews: turn preview features on/off in admin settings to keep production GA-only — https://learn.microsoft.com/azure/databricks/admin/workspace-settings/manage-previews
• Compliance Security Profile (CSP): a compliance hardening profile (not a feature freeze). Restricts to compliance-supported features, enforces a hardened image with enhanced monitoring, automatic cluster updates within your maintenance windows, and TLS 1.2+. On Azure it requires the Premium plan. It does not stop GA updates.
  • CSP: https://learn.microsoft.com/azure/databricks/security/privacy/security-profile
  • Enhanced security monitoring: https://learn.microsoft.com/azure/databricks/security/privacy/enhanced-security-monitoring
  • Automatic cluster update: https://learn.microsoft.com/azure/databricks/admin/clusters/automatic-cluster-update

Suggested production baseline:

• Keep personnel access + PATs off; use Microsoft Entra ID identities with short-lived tokens.
• Centralize system.access.audit and alert on high-risk events (admin roles, token policy, workspaceConfKeys, cluster policies, Unity Catalog grants, secrets).
• Manage config via Terraform/IaC for reviewable, version-controlled change — https://registry.terraform.io/providers/databricks/databricks/latest/docs
• Separate dev/test/prod and add Azure Policy + RBAC + resource locks.

Thanks,

Emma