County security asks who should be allowed to restart a production job cluster that processes resident PII extracts. What is the appropriate approach?

County security determining who may restart a production job cluster processing resident PII extracts should grant manage/restart permissions only to authorized operations principals that support that PII job. Production compute that touches PII is a privileged operational boundary: restart rights can interrupt jobs, alter availability, and potentially coincide with elevated manage actions, so least privilege to named ops/on-call groups is the appropriate municipal control.

Granting restart rights to every Entra user in the tenant including guests vastly overshares control of PII pipelines. Allowing anonymous workspace viewers to restart production PII clusters is incompatible with confidentiality and change control. Removing all cluster ACLs so on-call staff can restart without authentication eliminates accountability and violates basic access-control expectations for resident data workloads.

Exam caveat: distinguish CAN ATTACH vs CAN MANAGE/restart permissions; not every analyst who can run a notebook should restart production job clusters. Pair compute ACLs with Unity Catalog permissions and secrets ACLs—restart rights alone do not equal data access, but they are still sensitive. Break-glass accounts should be audited, not achieved by deleting ACLs.

Operational check: assign manage/restart on the PII job compute to an operations group only, test that analysts can view run status without restart rights if appropriate, log restart events, and document on-call procedures that use those authorized principals.