Verify workspace assignments

The Databricks Account Console manages organisation-wide settings (billing, identity, workspaces, Unity Catalog metastores), while the Workspace Console handles day-to-day operations within a single workspace (notebooks, clusters, jobs, data). Understanding which console controls what prevents confusion and ensures you configure settings in the right place.

    Who this is for:

    Part of the Getting Started with Databricks section of the Databricks tutorial series.

    Architecture / Concept Overview: Verify workspace assignments

    Databricks uses a hierarchical model: one account contains multiple workspaces. The Account Console operates at the top level, while each workspace has its own console for day-to-day work. This separation ensures that organisational policies are set centrally while individual teams have autonomy within their workspaces.

    %%{init: {"theme":"base","themeVariables":{"background":"#0B0E14","primaryTextColor":"#E0E6ED","lineColor":"#5D6470","darkMode":true,"primaryColor":"#2E4A4A","secondaryColor":"#374151","secondaryTextColor":"#E0E6ED","tertiaryColor":"#111827","tertiaryTextColor":"#E0E6ED","edgeLabelBackground":"#1f2937"}}}%% graph TD classDef source fill:#3F4B59,stroke:#9CA3AF,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef ingestion fill:#5A4B36,stroke:#C9A86B,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef processing fill:#535072,stroke:#8E82B4,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef storage fill:#2E4A4A,stroke:#5FAFA8,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef serving fill:#3D5550,stroke:#6BB7AA,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef governance fill:#5A3F52,stroke:#C28BB0,stroke-width:2px,rx:8,ry:8,color:#E0E6ED AC[Account Console] AC --> WSMgmt[Workspace Management] AC --> Identity[Identity & Access] AC --> Billing[Billing & Usage] AC --> UC[Unity Catalog Config] WSMgmt --> WS1[Workspace A Console] WSMgmt --> WS2[Workspace B Console] WS1 --> Notebooks[Notebooks] WS1 --> Compute[Compute] WS1 --> Jobs[Jobs] WS2 --> Data[Data] WS2 --> SQL[SQL Editor] class AC governance class WSMgmt governance class Identity ingestion class Billing source class UC storage class WS1 processing class WS2 processing class Notebooks serving class Compute serving class Jobs serving class Data storage class SQL serving

    *Figure 1 — Account Console governs the organisation; Workspace Consoles handle day-to-day operations.*

    %%{init: {"theme":"base","themeVariables":{"background":"#0B0E14","primaryTextColor":"#E0E6ED","lineColor":"#5D6470","darkMode":true,"primaryColor":"#2E4A4A","secondaryColor":"#374151","secondaryTextColor":"#E0E6ED","tertiaryColor":"#111827","tertiaryTextColor":"#E0E6ED","edgeLabelBackground":"#1f2937"}}}%% flowchart LR classDef source fill:#3F4B59,stroke:#9CA3AF,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef ingestion fill:#5A4B36,stroke:#C9A86B,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef processing fill:#535072,stroke:#8E82B4,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef storage fill:#2E4A4A,stroke:#5FAFA8,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef serving fill:#3D5550,stroke:#6BB7AA,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef governance fill:#5A3F52,stroke:#C28BB0,stroke-width:2px,rx:8,ry:8,color:#E0E6ED AccAdmin[Account Admin] --> AC2[Account Console] WSAdmin[Workspace Admin] --> WSC[Workspace Console] User[Regular User] --> WSC AC2 --> Global[Org-wide Settings] WSC --> Local[Workspace Settings] class AccAdmin governance class WSAdmin processing class User source class AC2 governance class WSC serving class Global governance class Local serving

    *Figure 2 — Role-based access: account admins, workspace admins, and regular users have different console access.*

    %%{init: {"theme":"base","themeVariables":{"background":"#0B0E14","primaryTextColor":"#E0E6ED","lineColor":"#5D6470","darkMode":true,"primaryColor":"#2E4A4A","secondaryColor":"#374151","secondaryTextColor":"#E0E6ED","tertiaryColor":"#111827","tertiaryTextColor":"#E0E6ED","edgeLabelBackground":"#1f2937"}}}%% flowchart LR classDef source fill:#3F4B59,stroke:#9CA3AF,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef ingestion fill:#5A4B36,stroke:#C9A86B,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef processing fill:#535072,stroke:#8E82B4,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef storage fill:#2E4A4A,stroke:#5FAFA8,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef serving fill:#3D5550,stroke:#6BB7AA,stroke-width:2px,rx:8,ry:8,color:#E0E6ED classDef governance fill:#5A3F52,stroke:#C28BB0,stroke-width:2px,rx:8,ry:8,color:#E0E6ED IdP[Identity Provider] --> SCIM[SCIM Sync] SCIM --> AccountGroups[Account-Level Groups] AccountGroups --> WS1Groups[Workspace A Groups] AccountGroups --> WS2Groups[Workspace B Groups] class IdP source class SCIM ingestion class AccountGroups governance class WS1Groups processing class WS2Groups processing

    *Figure 3 — Identity federation: users and groups sync from IdP to account level, then propagate to workspaces.*

    Key Terms

    Prerequisites and Setup

    • Account admin credentials (for Account Console access)
    • Workspace admin or user credentials (for Workspace Console access)
    • Understanding of your organisation's identity provider setup
    • Knowledge of which workspaces exist in your account

    Step-by-Step Implementation

      Configuration Reference

      Verify workspace assignments configuration options
      SettingConsoleWho Can Configure
      Create workspacesAccountAccount admin
      SCIM provisioningAccountAccount admin
      Metastore creationAccountAccount admin
      Billing budgetsAccountAccount admin
      SSO configurationAccountAccount admin
      Cluster policiesWorkspaceWorkspace admin
      User workspace accessAccountAccount admin
      SQL warehouse creationWorkspaceWorkspace admin
      Notebook permissionsWorkspaceObject owner
      Secret scopesWorkspaceWorkspace admin

      Monitoring, Cost, and Security Considerations

      Monitoring

      Use the Account Console billing dashboard for organisation-wide spend tracking. Use workspace-level system tables for granular query-level cost attribution. Set up account-level budget alerts for proactive cost management.

      Cost Optimisation

      Review cross-workspace usage patterns in the Account Console to identify consolidation opportunities. Ensure idle workspaces are identified and decommissioned. Use account-level budgets to cap spend per workspace or team.

      Security and Governance

      Configure SSO at the account level so all workspaces inherit consistent authentication. Use account-level groups for permission management — changes propagate to all workspaces automatically. Enable audit log delivery from the Account Console for compliance.

      Common Pitfalls and Recommended Patterns

      • Confusing account admin with workspace admin roles — they control different scopes
      • Managing users per-workspace instead of at account level — leads to inconsistent access across environments
      • Not configuring SCIM — manual user management does not scale beyond a handful of users
      • Looking for billing in the workspace console — it lives in the Account Console
      • Creating metastores from workspace admin settings — metastore creation is an account-level operation
      • Not assigning a metastore admin — Unity Catalog governance requires explicit ownership

      Frequently Asked Questions

      Can I be an account admin and workspace admin simultaneously?

      Yes. Account admins can grant themselves workspace admin on any workspace. In practice, these roles are often held by the same platform team members.

      Where do I manage Unity Catalog settings?

      Metastore creation and assignment happens in the Account Console. Catalog and schema management happens in the Workspace Console's Data section or via SQL.

      How do I switch between account and workspace consoles?

      The Account Console and Workspace Console are separate web applications with different URLs. Bookmark both. Some workspace UIs have a link to the Account Console in the admin menu.

      Can workspace admins see billing data?

      By default, only account admins see billing in the Account Console. Workspace users can query system.billing.usage tables if granted access.

      What happens if my account admin leaves the organisation?

      Transfer account admin privileges to another user before offboarding. If locked out, contact Databricks support with proof of account ownership.