Hi @Moira Fascioli ADM
Pritam Kabiraj explanation is on the right track "RUN AS: NULL"
typically appears when Databricks jobs or cluster activities are initiated without a specific user context. This can happen in scenarios such as:"
- Jobs or pipelines triggered by service principals
- Scheduled or automated tasks (like those started via APIs or orchestration tools)
- Shared or legacy clusters where individual user attribution isn’t configured
This is likely why you’re seeing high costs under "NULL"
and relatively low costs under named users — much of the compute usage may be driven by non-interactive, system-level processes.
To improve visibility and cost attribution, here are some steps you can take:
- Review job configurations – Check whether jobs are running using a service principal or system identity, and whether
Run As
user is explicitly set. - Use tagging – Apply cluster and job-level tags (e.g., owner, department, team) to help attribute costs correctly.
- Enforce cluster policies – You can use cluster policies to require tagging or assign default user context.
- Audit shared cluster usage – Consider moving from shared interactive clusters to job clusters or single-user clusters to improve tracking.
- Check audit or diagnostic logs – Azure Diagnostic Logs or Databricks audit logs can help trace the source of usage that's appearing as
"NULL"
.
I hope this information helps. Please do let us know if you have any further queries.
Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.