Dashboard owner/run_as conflict

[kmarq]

Describe the issue

DAB deployment for dashboard is failing if the bundle has a run_as user set that is different than the ID for the deployment.
Error: dashboards do not support a setting a run_as user that is different from the owner.

Run Identity documentation calls out model serving but not dashboards as an exception so I did not expect this behavior.
https://docs.databricks.com/aws/en/dev-tools/bundles/run-as

Configuration

Any dashboard with a run_as defined in the bundle that is different than the user running it.
targets:
test:
run_as:
service_principal_name: ${var.spn_etl_id}
resources:
dashboards:
example_dashboard:
display_name: "example_dashboard"
file_path: ./example_dashboard.lvdash.json

Steps to reproduce the behavior

Please list the steps required to reproduce the issue, for example:

1. Run Databricks bundle deploy or validate against the target with a run_as defined

Expected Behavior

Dashboard would deploy, owned by the ID running the deployment and have no interaction with the run_as setting since the dashboard (especially with embed_credentials: false) does not need to use the run_as identity at all.

Actual Behavior

Error message:
Error: dashboards do not support a setting a run_as user that is different from the owner.

OS and CLI version

Linux: Debian GNU/Linux 13
CLI: v0.286.0 & CLI v0.283.0

Is this a regression?

No

Debug Logs

Output logs if you run the command with debug logs enabled. Example: databricks bundle deploy --log-level=debug. Redact if needed

[iammuntazirali]

I think I can help resolve this issue. Please let me know if I should proceed.

[iammuntazirali]

Thanks for the detailed report — I understand the issue.

What’s happening is that dashboards implicitly require the run_as identity to match the dashboard owner. When a bundle target defines run_as with an identity different from the deploying user or service principal, dashboard validation/deployment fails with the ownership error you’re seeing.

This appears to be expected behavior for dashboards, but it’s currently undocumented. The Run Identity documentation calls out some exceptions (e.g., model serving) but does not mention dashboards, which makes this behavior surprising.

Next steps I can take:

• Confirm whether this is an intentional product limitation vs. a CLI/bundles bug
• Improve error messaging to clearly state that dashboards require run_as to match the owner
• Propose a documentation update clarifying that dashboards do not support a different run_as identity and recommending isolation into a separate bundle

Please let me know which direction you’d prefer, or if there’s additional context I should be aware of before proceeding.

[kmarq]

That's an accurate summary.
If I was able to choose a direction, I would say that generally across DABs I would want to see run_as restrictions like this not cause failures. Definitely throw a warning if it can't be applied, but for items like Dashboards that don't set a run_as at all, I would want to see them deploy as normal vs having to break them out into a separate bundle which causes a lot of additional overhead and forces us to design our product folder structure around DAB limitations instead of what actually makes up a data product.