Hi, Everything @binlogreader  has commented above is correct, the app service principal will be what appears in the system tables and if you'd like to get individual user authentication you'll need to use OBO authorisation, or pull somthing from the headers, but this would be seperate to the system tables. To give some additional pointers:

- The run as and run by are used for jobs and shared group compute where one identity triggers the work but it's run as another.

- You will be able to extract the user from the headers.  Docs are here: https://learn.microsoft.com/en-us/azure/databricks/dev-tools/databricks-apps/http-headers

There are some nice examples in the docs of the usable headers.

Thanks,

Emma