Now GA: Building Permission-Aware Databricks Apps with On-Behalf-of-User Authorization
Databricks, Wednesday, October 7th, 2026
On-behalf-of-user authorization for Databricks Apps is now GA, letting apps act with the signed-in user's own data permissions.
Databricks made on-behalf-of-user (OBO) authorization generally available for Databricks Apps.
With OBO, an app calling supported Databricks APIs acts as the signed-in user, so Unity Catalog enforces that user's permissions, including row filters and column masks, while API scopes limit the app's operations and its own service principal can still handle app-owned work.
Design guidance includes deciding whose permissions govern each operation, keeping app and user clients separate, using the forwarded token only for the active request, failing closed if it is missing and never storing user tokens.