Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
This feature is in Beta.
Account-only users are users who are added to your Azure Databricks account through automatic identity management (AIM) or account-level System for Cross-domain Identity Management (SCIM) but aren't assigned to a workspace. They have limited access to account-level Genie One without a workspace entitlement.
With AIM, Azure Databricks provisions an account-only user on first login and syncs their group memberships from the registered identity provider. With account-level SCIM, account admins provision users before they log in.
Account-only user capabilities
Account-only users can:
- Chat with data available at the metastore level and interact with Genie Agents and dashboards shared with them.
- Create Genie One skills and documents, which are stored in the same region as the metastore.
- Access Genie One through your account's custom URL.
Account-only users cannot access data that is bound to a workspace. To access workspace-bound data, assign the user to the bound workspace with Consumer access. See What is consumer access?.
Requirements
To provide account-only user access, configure the following:
- Enable AIM or account-level SCIM provisioning. Databricks recommends AIM because it uses your identity provider as the source of record and syncs users and group memberships on login.
- Enable Account-only users in Genie One in the account console. Go to Settings > Account Settings.
Control account-only user access
Unity Catalog privileges determine which data each account-only user can access. Databricks recommends granting the all account users group access to a curated starter dashboard, metric view, table, or Genie Agent. Starter data gives newly provisioned users relevant data to ask about when they first use Genie One.
Because objects shared with all account users are available to account-only users, review existing shares before you enable account-only access. Use the Security Analysis Tool (SAT) version 0.9.0 to identify data and assets shared with all account users.
Account admins can use the following controls:
- Use AIM access denylists to prevent specific identities from accessing your account.
- Apply account IP access lists to account-level Genie One. See Configure IP access lists for the account console.
- Use catalog-workspace bindings to prevent account-only users from accessing data bound to a workspace. To access bound data, a user must be assigned to the bound workspace.
Complimentary compute
Azure Databricks provides complimentary serverless compute and tokens for account-only users on a best-effort basis. If a user exhausts the complimentary compute, they can wait for it to refresh.
For full access through a workspace, assign the user to a workspace with Consumer access and grant them CAN USE permission on a SQL warehouse. Standard Genie cost controls and alerts apply to workspace usage.
Limitations
The following limitations apply:
- Data behind a network connectivity configuration isn't supported.
- External tool connections that use Model Context Protocol (MCP) cannot write data.
- Account-only users cannot schedule recurring tasks.
- Workspaces that use the compliance security profile aren't supported.