Control workspace asset sharing with RBAC

Workspace administrators can restrict selected role-based access control (RBAC) roles from sharing the workspace assets they own in Azure Databricks. Configure the Restrict sharing for groups setting, then verify the restriction while acting as a role. The setting supports up to 100 groups by default.

Workspace asset sharing controls

When users assume a role, they can create workspace assets (notebooks, SQL queries, SQL warehouses, jobs) that the role owns. By default, the role can share those assets with other workspace users. For example, publishing a dashboard with shared data permissions allows viewers to run queries using the publisher's data permissions, even if they lack direct access to the underlying data. See What are shared data permissions?.

The workspace-level Restrict sharing for groups setting prevents selected groups from sharing workspace assets they own. These groups are typically roles configured for exclusive access.

Requirements

You must be a workspace administrator to configure workspace asset sharing controls.

How the restriction applies

The restriction applies when a user or service principal assumes a listed group or a group nested under it as a role.

This setting controls sharing permissions on workspace assets owned by the restricted role. It does not change privileges on Unity Catalog objects or prevent every way that someone with access to data could copy or disclose it.

• Users and service principals acting as their own identities can share any workspace asset they own or can manage, even if they are members of a listed group.
• A user acting as a listed group cannot share workspace assets owned by that group, even with Can Manage permission on the asset.
• A user acting as a group nested under a listed group is also restricted. For example, if the list contains clinical-trial-1, and clinical-trial-1-analysts is nested under it, users acting as clinical-trial-1-analysts are also restricted.

Limits and constraints

The following limits apply to the list of restricted groups:

• System groups can't be added: System groups, such as account users, admins, users, and account admins, can't be added to the restrict sharing list. This restriction can't be overridden.
• Group count: By default, you can add up to 100 groups to the restrict sharing list. Contact your Azure Databricks account team if you need a higher limit.

Configure sharing controls

To restrict a group from sharing workspace assets it owns:

1. In the Azure Databricks workspace, click your username in the upper right and select Settings.
2. Click the Advanced tab.
3. Find Restrict sharing for groups.
4. Click the edit button.
5. Browse, search for, and select the groups you want to restrict.
6. Click Save.

Verify the restriction

To verify that the restriction is working:

1. Assume a restricted role using any of the supported methods. See Switch RBAC roles.
2. Open or create a workspace asset owned by the role (for example, a notebook).
3. Attempt to share the asset.

The share option is unavailable for assets owned by restricted roles.

Additional resources

Resource	Description
Tutorial: Model exclusive access with RBAC	Configure and verify exclusive access for two clinical trials, including restrictions on sharing role-owned workspace assets.
Switch RBAC roles	Assume a role using the role switcher, dedicated access mode clusters, the Databricks CLI, the API, or third-party BI tools.
Role-based access control (RBAC) limitations	Understand which Azure Databricks features are not supported or only partially supported when acting as a role.