topic RLS Impact on Lake house monitoring quality metrics in Data Governance

RLS Impact on Lake house monitoring quality metrics

karunakaran_r — Thu, 07 Aug 2025 18:53:29 GMT

We have RLS applied on a table and we would like to enable lake house monitoring for a quality profile metrics ,

My Questions:
Which identity is used by Lakehouse Monitoring and how can I find it, so that I can exclude it for unrestricted access to table in our RLS policy.

Re: RLS Impact on Lake house monitoring quality metrics

lingareddy_Alva — Mon, 11 Aug 2025 14:39:20 GMT

Hi @karunakaran_r

In Databricks Lakehouse Monitoring, the profiling and drift metric collection runs as a service principal that’s tied to the Databricks system itself, not as your own user account.
That means when the monitor queries your table, it won’t be using your personal identity — it uses the Lakehouse Monitoring service identity
(sometimes referred to as the system service principal for lakehouse monitoring).

How to find it for RLS exclusions:
- Go to Admin Console → Service Principals in your Databricks workspace (you need admin permissions).
- Look for a principal with a name like:
databricks-lakehouse-monitoring
- Note its Service Principal ID (or application ID in Azure AD).
- Update your Row-Level Security policy to include a clause that grants unrestricted access when current_user() or the principal ID equals that service principal.

Re: RLS Impact on Lake house monitoring quality metrics

karunakaran_r — Fri, 15 Aug 2025 16:25:28 GMT

Thank you @lingareddy_Alva