We're deploying a Databricks App using Service Principal (SP) mode (not using OBO's user_api_scopes).

The sample query "List app actions performed on behalf of users" in Logging and Monitoring for Databricks Apps shows system.access.audit.user_identity.email commented as "Logged-in user" (the actual person who logged in), with identity_metadata.acting_resource holding the app/SP-side identifier.

My questions:

1. Does this behavior only apply when On-Behalf-Of User Authorization (OBO) is enabled? Or does a pure SP-mode app (without user_api_scopes) also populate user_identity.email with the actual end user's email whenever they interact with the app?
2. The Audit log system table reference documents run_by / run_as fields under identity_metadata — do these also apply to the Databricks Apps SP-mode case specifically?

We need to confirm, for internal compliance purposes, whether individual end users can be identified at the audit-log level, and couldn't find an explicit statement in the official docs covering this exact combination. Any pointers to documentation or real-world behavior would be appreciated.