Databricks workspace access assignments

Lists every principal assigned to a Databricks workspace with its permission level. The view resolves all three principal types into one result - users, groups and service principals - so a single query answers "who can reach this workspace and at what level", which is the core access review question.

Query

SELECT
principal_id,
display_name,
user_name,
group_name,
service_principal_name,
permission
FROM databricks_account.iam.vw_workspace_assignments
WHERE account_id = '{{account_id}}'
AND workspace_id = '{{workspace_id}}';

Related identity views

The account IAM service exposes the same shape for group membership and role assignment across the account rather than one workspace:

SELECT * FROM databricks_account.iam.vw_account_group_members
WHERE account_id = '{{account_id}}';

SELECT * FROM databricks_account.iam.vw_account_service_principal_roles
WHERE account_id = '{{account_id}}';

Notes

workspace_id is required: without it the call fails with HTTP 404 and RESOURCE_DOES_NOT_EXIST 'Workspace not found' rather than listing every workspace, so enumerate workspaces first with databricks/provisioning/workspaces-list and iterate. Exactly one of user_name, group_name and service_principal_name is populated per row and the other two are null, which is how the principal type is determined - a row carrying service_principal_name is an application identity rather than a human, and those are the ones worth checking for ADMIN. permission is ADMIN or USER at the workspace level; finer-grained object permissions live in the databricks_workspace provider and need workspace-scoped credentials. Prefer these vw_ views to the raw resources: they are embedded in the provider with per-dialect implementations, so they behave identically on the SQLite and PostgreSQL backends.