ExamFinch.com My Study

Study guide

9.2 Publishing, Sharing & Access Control

Practice this exam

Databricks Certified Data Analyst Associate Exam

Track your progress as you read

Finished sections get a check mark.

1 Platform Overview & Unity Catalog Foundations

1.1 Databricks Architecture & Compute Concepts 1.2 Databricks Marketplace & Data Sharing Basics 1.3 Unity Catalog Namespace & Object Hierarchy 1.4 Governed Asset Discovery & System Tables

2 Managing & Cleaning Governed Data

2.1 Dataset Discovery & Asset Tagging 2.2 Lineage Inspection & Data Traceability 2.3 SQL Data Cleaning & Transformation Techniques

3 Data Ingestion & Import Patterns

3.1 Workspace Uploads & Cloud File Ingestion 3.2 Incremental File Ingestion with Auto Loader 3.3 Ingesting Data via Delta Sharing & External Connections

4 Databricks SQL Warehouses & Core Querying

4.1 Databricks SQL Interface & SQL Assistant 4.2 SQL Warehouses Sizing & Management 4.3 Table Creation & Data Modification in Databricks SQL

5 Advanced SQL Authoring & Time Travel

5.1 Advanced Aggregations, Window Functions & Analytics 5.2 Complex Joins, CTEs & Set Operations 5.3 Views, Materialized Views & Delta Time Travel

6 Query Performance Analysis & Photon Engine

6.1 Photon Engine Architecture & Acceleration 6.2 Query History & Execution Profile Inspection 6.3 Delta Lake Audit History & Commit Logs

7 Liquid Clustering, Caching & Performance Troubleshooting

7.1 Caching Hierarchy in Databricks SQL 7.2 Data Layout Optimization: Liquid Clustering vs Partitioning & Z-Ordering 7.3 Troubleshooting Slow & Failing Queries

8 AI/BI Dashboards & Visualization Design

8.1 AI/BI Dashboards Overview & Canvas Layout 8.2 Chart Types & Visualization Selection 8.3 Notebook & SQL Editor Visualizations

9 Dashboard Interactivity, Publishing & Alerts

9.1 Dashboard Parameters & Interactive Filtering 9.2 Publishing, Sharing & Access Control 9.3 Scheduled Refresh, Email Subscriptions & Alerts

10 Developing & Maintaining AI/BI Genie Spaces

10.1 AI/BI Genie Architecture & Space Setup 10.2 Curation via Instructions, Descriptions & Sample Questions 10.3 Trusted Assets & Parameterized Functions 10.4 Monitoring, Benchmarks, Feedback & Maintenance

11 Data Modeling & Medallion Architecture

11.1 Dimensional Modeling Fundamentals 11.2 Medallion Architecture for Analytics 11.3 Constraint Enforcement & Relationships in Unity Catalog

12 Securing Data & Unity Catalog Governance

12.1 Unity Catalog Privilege Model & Grants 12.2 Ownership, Inheritance & Access Control Patterns 12.3 Fine-Grained Security: Row Filters & Column Masks

9.2 Publishing, Sharing & Access Control

Key Takeaways Explain This Topic AI

AI/BI Dashboards feature strict draft vs. published separation; editing a draft canvas does not alter the viewer experience until explicit publication occurs.

Workspace access control supports CAN EDIT, CAN RUN, and CAN VIEW permissions managed via Unity Catalog privileges and workspace ACLs.

Embed Credentials mode allows viewers without direct warehouse access or underlying table privileges to view dashboard data using the publisher's credential context.

Run as Viewer credential mode enforces Unity Catalog row filters and column masks for each individual user viewing the published dashboard.

Embedding AI/BI Dashboards into external portals requires enabling OAuth 2.0 or iframe embedding settings within Databricks workspace admin settings.

Last updated: July 2026

Publishing, sharing, and access control represent the core governance model for Databricks AI/BI Dashboards. Because dashboards in Databricks interact directly with data governed by Unity Catalog, administrators and analysts must understand how draft states, publication workflows, permission levels, and credential execution modes operate to balance user accessibility with strict enterprise security.

The Draft vs. Published Lifecycle

Databricks AI/BI Dashboards maintain a strict operational boundary between the Draft Canvas and the Published Dashboard . This separation ensures data analysts can iteratively refine dataset queries, adjust visual layouts, and test parameter bindings without disrupting business users viewing active reports.

State Isolation Mechanics

Draft State : The interactive authoring environment where creators build SQL datasets, drag and drop canvas widgets, configure color palettes, and test parameter controls. Changes made in draft mode are auto-saved immediately but remain completely invisible to dashboard consumers.

Published State : A locked snapshot of the dashboard canvas and dataset definitions generated when the author clicks the Publish button. Consumers viewing the published dashboard interact exclusively with this snapshot.

Re-Publishing & Version Rollback : Clicking Publish overwrites the previous published version with the current draft state. Authors can revert their draft canvas to match the currently published snapshot if experimental changes need to be discarded.

When an analyst modifies a SQL dataset query in draft mode—such as adding a new calculation or altering a JOIN clause—the published dashboard continues executing the previous query definition until the analyst explicitly publishes the updated draft.

Credential Execution Modes: Run as Viewer vs. Embed Credentials

When publishing an AI/BI Dashboard, the author must select one of two credential execution modes: Run as Viewer (User Credentials) or Embed Credentials (Run as Owner / Publisher Credentials). This setting dictates how queries are executed against Databricks SQL Warehouses and how Unity Catalog access controls are enforced.

Run as Viewer (User Credentials)

In Run as Viewer mode, every query issued by the published dashboard runs under the specific identity of the person currently viewing the dashboard.

Unity Catalog Privilege Requirements : The viewer must possess explicit SELECT privileges on all underlying Unity Catalog tables, views, and schemas referenced by the dashboard datasets.

SQL Warehouse Access : The viewer must have CAN USE privileges on the Databricks SQL Warehouse assigned to the dashboard.

Security Enforcement : Unity Catalog row-level filters and column-level masks are dynamically evaluated for each individual viewer. If User A is restricted to viewing US customer data while User B can view EU data, the exact same dashboard canvas automatically renders US data for User A and EU data for User B.

Embed Credentials (Publisher Credentials / Run as Owner)

In Embed Credentials mode, all queries execute using the credentials and permissions of the dashboard publisher (or designated service principal owner).

Viewer Access Requirements : Viewers require only workspace CAN VIEW permission on the dashboard object. They do not need direct SELECT permissions on underlying Unity Catalog tables, nor do they need CAN USE access on the SQL Warehouse.

Aggregated Distribution : This mode is ideal for broadcasting executive summary dashboards or broad operational KPIs to hundreds of stakeholders who lack direct access to raw data tables or SQL Warehouses.

Security Implications : Because queries execute with the owner's privileges, Unity Catalog row filters and column masks assigned to the viewer are bypassed . Security must be ensured by verifying that dataset queries in the dashboard perform appropriate aggregations and do not expose sensitive raw PII.

  • Security & Execution Dimension Run as Viewer (User Credentials) Embed Credentials (Owner Credentials)
  • Query Execution Identity Viewer's individual Databricks user identity Publisher's / Owner's identity
  • Table Privilege Required Explicit SELECT on Unity Catalog tables None (Owner's privileges used)
  • SQL Warehouse Privilege CAN USE on assigned SQL Warehouse None (Owner's warehouse access used)
  • Row Filters & Column Masks Enforced per individual viewer identity Evaluated against Publisher identity
  • Primary Use Case Self-service analytics for technical analysts Broad executive reporting & public sharing
  • Workspace Access Control & Permission Levels

Access to AI/BI Dashboards within a Databricks workspace is governed by Workspace Access Control Lists (ACLs). Dashboard owners can grant three distinct permission levels to individual workspace users, user groups, or Service Principals:

CAN EDIT : Allows users to modify SQL dataset queries, alter canvas layouts, edit widget configurations, change publishing settings, and manage dashboard permissions.

CAN RUN : Allows users to view published dashboards, trigger manual dataset query refreshes, change interactive parameter filters, and view execution history. Users cannot alter canvas layout or dataset SQL code.

CAN VIEW : Allows users to view the published dashboard snapshot and interact with client-side parameter controls. If the dashboard uses "Run as Viewer" mode, CAN VIEW users must also have table SELECT and warehouse CAN USE permissions. -- Conceptual Unity Catalog grant command for supporting Run as Viewer dashboards

  • GRANT SELECT ON TABLE main.sales_gold.fact_orders TO `finance_analysts_group`;
  • GRANT USE SCHEMA ON SCHEMA main.sales_gold TO `finance_analysts_group`;
  • GRANT USE CATALOG ON CATALOG main TO `finance_analysts_group`;
  • Dashboard Ownership Management

Every dashboard has a single owner—typically the user who created it. If a dashboard owner leaves the organization or transitions teams, workspace administrators must transfer ownership to an active user or a Service Principal . Ownership transfer is critical for dashboards operating in "Embed Credentials" mode; if the owner's Databricks account is deactivated, queries under Embed Credentials mode will fail until ownership is reassigned.

External Embedding & Sharing Controls

Databricks AI/BI Dashboards can be shared securely outside the workspace UI.

Direct URL Sharing : Workspace users with appropriate permissions can access published dashboards via unique workspace URLs.

Iframe Embedding : Dashboards configured with Embed Credentials can be embedded into internal enterprise portals (such as SharePoint, Salesforce, or custom React applications) using <iframe> tags.

OAuth 2.0 Authentication : Embed scenarios can leverage Databricks OAuth 2.0 M2M (Machine-to-Machine) or User-to-Machine tokens to establish seamless single sign-on (SSO) without prompting end-users for login credentials.

Workspace Admin Guardrails : Workspace administrators retain overarching security controls in the Databricks Admin Console. Admins can globally disable dashboard iframe embedding, restrict external link sharing, or enforce mandatory "Run as Viewer" execution across all workspace dashboards.