Topic starter
24/10/2026 8:52 pm
TL;DR: Effective access in Databricks breaks down when identity provider views miss workspace and Unity Catalog permissions, Oleria Security reports. Databricks can still carry standing access through tokens and service principals, so periodic reviews may miss who can actually reach data and compute.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security & governance for Databricks”.
By the numbers:
- 30.9% of organisations store long-term credentials directly in code, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
Key questions
Q: Why do Databricks personal access tokens create governance risk?
A: Personal access tokens create risk because they can keep authenticating workloads outside normal SSO and MFA enforcement.
Q: How should security teams govern Databricks service principals and tokens?
A: Treat them as governed non-human identities with named ownership, expiry, rotation, and offboarding requirements.
Q: What breaks when Databricks governance stops at the identity provider?
A: Effective access breaks down because the identity provider cannot fully describe permissions that are created inside workspaces and Unity Catalog.
Practitioner guidance
- Map effective Databricks access across all planes Trace permissions from the identity provider into workspace roles, nested groups, Unity Catalog grants and compute usage so reviews reflect actual reach.
- Inventory and age all Databricks tokens Track personal access tokens, OAuth secrets and secret scopes with creation date, expiration date and owner so stale credentials stand out.
- Review service principal permissions against real usage Compare service principal entitlements with audit logs for jobs, pipelines and notebooks, then remove catalog or workspace rights that are never exercised.
Bottom line: Databricks governance fails when teams trust directory views that do not reflect workspace, catalog and compute access.
Glossary terms: Effective Access, Personal Access Token (PAT), Unity Catalog, Service Principal
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Databricks governance fails at the effective-access layer, not the directory layer. Identity provider centric IGA can show who belongs to a group, but it does not automatically resolve the permissions that arrive through workspace roles, nested groups, object ownership or Unity Catalog grants. That means the control failure is structural: the system being reviewed is not the system actually enforcing access. Practitioners should govern the permission path, not the directory label.
A few things that frame the scale:
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
A question worth separating out:
Q: How do teams know Databricks access is actually under control?
A: Access is under control when effective permissions match intended business use across account, workspace and data layers. Teams should be able to show that dormant users, stale tokens and over-provisioned principals are removed on an ongoing basis, not just flagged in a report. If review findings do not translate into direct revocation, the governance model is not complete.
👉 Read our full editorial: Databricks identity governance fails when access spans workspaces
This post was modified 6 days ago by NHI Mgmt Group