We ran into a similar governance concern and looked at it from both a prevention and a monitoring perspective.
From what we've seen, scheduled SQL queries are different from the traditional Jobs that users create in the Jobs UI, which makes them harder to discover through normal operational monitoring. Relying on SQL Warehouse query history is possible, but it's manual and doesn't scale.
A few approaches that may help:
1. Restrict who can create scheduled queries (preferred)
If your organization doesn't want users creating their own scheduled SQL queries, the simplest solution is to limit scheduling capabilities to a specific group while allowing others to run queries interactively.
2. Monitor scheduled queries programmatically
Instead of checking query history, periodically query the Databricks Jobs metadata (or use the Jobs REST API) to identify jobs that contain SQL tasks. Run this on a schedule (for example, hourly or daily), compare it with the previous snapshot, and alert when new scheduled queries are created or existing ones are modified.
3. Use audit logs
If audit logging is enabled in your workspace, this is a good place to monitor schedule creation and other administrative events. It provides a much better governance trail than manually inspecting query history.
4. Governance by policy
In some organizations, scheduled queries are only created through an approved deployment process (for example, Infrastructure as Code or an internal request workflow), rather than allowing ad hoc scheduling by individual users.
If your primary goal is governance, I'd recommend combining permission restrictions with automated monitoring. That gives you both prevention and visibility without requiring someone to manually inspect warehouse query history.
I'd also be interested to hear if anyone has found a built-in way to enumerate scheduled SQL queries directly, as that would certainly simplify this use case.
