Databricks personal access tokens should be restricted and must expire

A personal access token works like a password for the Databricks API and often has no second factor. Long-lived tokens that anyone can create are easy to forget, leak into scripts and repositories, and keep working after a person changes role. Limiting who may create tokens and forcing expiry shrinks that exposure. Microsoft documents the controls here: Databricks personal access token authentication.

Tokens also outlive people. When an engineer leaves a team, a token they created can still run jobs under their identity, with the same permissions, until someone finds it. An enforced lifetime puts an upper limit on how long that can last.

In the workspace, open Settings, Advanced, Personal Access Tokens (admin only) to see whether token use is on and the maximum lifetime that is set; Permissions there shows who may create tokens. Read-only with the Databricks CLI:

databricks workspace-conf get-status enableTokensConfig,maxTokenLifetimeDays
databricks token-management list

An empty maximum lifetime means tokens can be created without an expiry limit.

Set a maximum lifetime that fits your needs and limit the Can use permission on tokens to the groups that need it. With the CLI:

databricks workspace-conf set-status --json '{"maxTokenLifetimeDays": "<days>"}'

Where possible move automation from personal tokens to service principals with Microsoft Entra ID authentication. ConfigCobra only reads your environment and never changes it; the steps below are for you or your administrator to run.

Users outside the approved group can no longer create tokens, and tokens older than the new limit stop working. Scripts, CI jobs and integrations that rely on such tokens will fail until they are given a new token or switched to a service principal, so list active tokens first and tell their owners before applying the change.

A good sequence is to export the list of existing tokens, contact the owners, move shared automation to service principals, and only then lower the maximum lifetime. Choose the lifetime with the owners of long-running jobs in mind, so you are not forced to loosen it after an outage. The remediation impact view in ConfigCobra lists the affected identities and resources before you apply a fix.