Configuring who can use a compute resource

Access to Azure Databricks compute (clusters) is managed through cluster-level permissions that determine who can attach to, restart, or manage a given cluster. These permissions require cluster access control (Premium tier or above) to be enabled and are configured via the cluster's Permissions tab or the Permissions API, assigning access to users, groups, or service principals.

1 · Learn the must-know

• 1Cluster access control is only available on the Premium plan (or higher); on Standard tier, all users with cluster-create rights can manage all clusters.
• 2Permission levels for clusters are hierarchical: Can Attach To (use only), Can Restart (use + restart), and Can Manage (full control including permission changes and termination).
• 3Workspace admins always have Can Manage on every cluster regardless of explicitly assigned permissions.
• 4Only a user with Can Manage permission (or an admin) can modify a cluster's permissions or delete it.
• 5Cluster policies can also carry their own permissions (Can Use), controlling who is allowed to create clusters based on that policy, independent of individual cluster permissions.
• 6If no explicit permissions are granted on a cluster, by default only its creator and workspace admins can use or manage it.

2 · Check your understanding