Notiz
Zougrëff op dës Säit erfuerdert Autorisatioun. Dir kënnt probéieren, Iech unzemellen oder Verzeechnesser ze änneren.
Zougrëff op dës Säit erfuerdert Autorisatioun. Dir kënnt probéieren, Verzeechnesser ze änneren.
This page lists the features and behaviors that do not work, or work only partially, when acting as a role. Features not listed here behave the same when acting as a role as they do when acting as your user identity.
For how identity-related SQL functions (current_user(), is_member, is_account_group_member) behave when assuming a role, see How identity functions behave when assuming a role.
Unsupported and partially supported features
The following features either do not work or behave differently when acting as a role:
- Agent Bricks: creating agents as a role is not supported.
- Alerts: managing alerts as a role is not supported.
- Apps: Connecting to an app works. An app can authorize as its own service principal or, when a user connects, as a role that user has permission to assume. An app's service principal cannot yet assume a role for programmatic (machine-to-machine) data access.
- Lineage: the
system.access.table_lineage.created_bycolumn is correctly populated with the role, but the user who assumed the role is not captured. - Pipelines: Lakeflow pipelines are not supported for roles.
- Serverless usage policies: When acting as a role, the workspaces drop-down menu in the serverless usage policy creation form is empty, so you can't scope a policy to specific workspaces. As a workaround, create the policy as your user identity.
- Vector Search: managing Vector Search endpoints as a role is supported, but creating indexes as a role fails. As a workaround, create the index as a user and then change the owner to a role. Querying vector endpoints and indexes as a role is captured correctly in audit events.
Identity and group management
- The workspace SCIM API (
/api/2.0/preview/scim/v2) does not support creating or managing groups. Use the Account SCIM API (/api/2.1/accounts/{account-id}/scim/v2/) or the Workspace Account SCIM API (/api/2.0/account/scim/v2/) instead. - Workspace asset sharing controls can be applied to a maximum of 100 groups by default. Additionally, system groups, such as
all account usersandadmins, cannot be restricted with workspace asset sharing controls. See Limits and constraints.
Known issues
When RBAC is enabled, a Power BI report that connects to Azure Databricks through the Databricks ODBC driver fails to reload when the report holds roughly 10 or more concurrent connections. Reports with only a few connections are not affected. This was observed with Databricks ODBC driver version 2.9.1.
The native Power BI connector for Azure Databricks is not affected. In Power BI Desktop, connect with the native connector instead of the ODBC driver: in Get data, search for Databricks or Azure Databricks. The native connector ships with Power BI, so there is nothing to install. See Connect Power BI Desktop to Azure Databricks.
Power BI Report Server and Microsoft Excel connect to Azure Databricks only through the ODBC driver. There is no workaround for those surfaces.