diff --git a/acceptance/bundle/config-remote-sync/job_run_as/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/job_run_as/databricks.yml.tmpl
index c655e36c9c2..cf5653eeec2 100644
--- a/acceptance/bundle/config-remote-sync/job_run_as/databricks.yml.tmpl
+++ b/acceptance/bundle/config-remote-sync/job_run_as/databricks.yml.tmpl
@@ -3,6 +3,23 @@ bundle:
 
 resources:
   jobs:
+    # run_as is not set in config, so the backend defaults it to the deployer.
+    no_run_as:
+      name: no-run-as-$UNIQUE_NAME
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+
+    # The terraform provider pins run_as to the job's identity on every update,
+    # so a remote run_as that names the creator is a default, not an edit.
+    no_run_as_creator:
+      name: no-run-as-creator-$UNIQUE_NAME
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+
     user_to_user:
       name: user-to-user-$UNIQUE_NAME
       run_as:
@@ -12,6 +29,7 @@ resources:
           notebook_task:
             notebook_path: /Users/{{workspace_user_name}}/notebook
 
+    # The creator default only applies when the config leaves run_as unset.
     user_to_creator:
       name: user-to-creator-$UNIQUE_NAME
       run_as:
diff --git a/acceptance/bundle/config-remote-sync/job_run_as/output.txt b/acceptance/bundle/config-remote-sync/job_run_as/output.txt
index 424cac25200..6080e872493 100644
--- a/acceptance/bundle/config-remote-sync/job_run_as/output.txt
+++ b/acceptance/bundle/config-remote-sync/job_run_as/output.txt
@@ -1,18 +1,23 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.no_run_as
+Created jobs.no_run_as_creator
 Created jobs.user_to_creator
 Created jobs.user_to_sp
 Created jobs.user_to_user
 Files: 2 uploaded, 0 deleted
-Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+Resources: 5 created, 0 changed, 0 deleted, 0 unchanged
 
 === Change run_as remotely
 
 === Detect and save changes
 
 >>> [CLI] bundle config-remote-sync --save
-Detected changes in 3 resource(s):
+Detected changes in 4 resource(s):
+
+Resource: resources.jobs.no_run_as
+  run_as: add
 
 Resource: resources.jobs.user_to_creator
   run_as.user_name: replace
@@ -29,21 +34,28 @@ Resource: resources.jobs.user_to_user
 >>> diff.py databricks.yml.backup databricks.yml
 --- databricks.yml.backup
 +++ databricks.yml
-@@ -7,5 +7,5 @@
+@@ -12,4 +12,6 @@
+             notebook_path: /Users/{{workspace_user_name}}/notebook
+
++      run_as:
++        service_principal_name: [UUID]
+     # The terraform provider pins run_as to the job's identity on every update,
+     # so a remote run_as that names the creator is a default, not an edit.
+@@ -24,5 +26,5 @@
        name: user-to-user-[UNIQUE_NAME]
        run_as:
 -        user_name: first-user@example.com
 +        user_name: second-user@example.com
        tasks:
          - task_key: main
-@@ -16,5 +16,5 @@
+@@ -34,5 +36,5 @@
        name: user-to-creator-[UNIQUE_NAME]
        run_as:
 -        user_name: first-user@example.com
 +        user_name: [USERNAME]
        tasks:
          - task_key: main
-@@ -25,5 +25,5 @@
+@@ -43,5 +45,5 @@
        name: user-to-sp-[UNIQUE_NAME]
        run_as:
 -        user_name: first-user@example.com
@@ -60,14 +72,16 @@ No changes detected.
 === Plan after sync
 
 >>> [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+Plan: 0 to add, 0 to change, 0 to delete, 5 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
+  delete resources.jobs.no_run_as
+  delete resources.jobs.no_run_as_creator
   delete resources.jobs.user_to_creator
   delete resources.jobs.user_to_sp
   delete resources.jobs.user_to_user
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Destroy: 3 deleted
+Destroy: 5 deleted
diff --git a/acceptance/bundle/config-remote-sync/job_run_as/script b/acceptance/bundle/config-remote-sync/job_run_as/script
index 5beb36780a5..ed68fef3637 100644
--- a/acceptance/bundle/config-remote-sync/job_run_as/script
+++ b/acceptance/bundle/config-remote-sync/job_run_as/script
@@ -8,6 +8,12 @@ trap cleanup EXIT
 trace $CLI bundle deploy
 
 title "Change run_as remotely"
+edit_resource.py jobs "$(read_id.py no_run_as)" <<'PY'
+r["run_as"] = {"service_principal_name": "11111111-2222-3333-4444-555555555555"}
+PY
+edit_resource.py jobs "$(read_id.py no_run_as_creator)" <<PY
+r["run_as"] = {"user_name": "$CURRENT_USER_NAME"}
+PY
 edit_resource.py jobs "$(read_id.py user_to_user)" <<'PY'
 r["run_as"] = {"user_name": "second-user@example.com"}
 PY
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/script b/acceptance/bundle/config-remote-sync/terraform_state/script
index 31d7b70bb7f..ffa1a1a9452 100644
--- a/acceptance/bundle/config-remote-sync/terraform_state/script
+++ b/acceptance/bundle/config-remote-sync/terraform_state/script
@@ -8,8 +8,11 @@ title "Replay a terraform deployment of the bundle (captured from a real terrafo
 trace replay_tfstate.py terraform-requests.json terraform.tfstate
 job_id="$(read_id.py test_job)"
 
+# Jobs updated by the terraform engine carry an explicit run_as naming the job's identity; that is
+# not a remote edit, so only max_concurrent_runs must be detected.
 edit_resource.py jobs $job_id <<EOF2
 r["max_concurrent_runs"] = 3
+r["run_as"] = {"user_name": "$CURRENT_USER_NAME"}
 EOF2
 
 title "config-remote-sync migrates the terraform state in memory and detects the remote change"
diff --git a/bundle/configsync/defaults.go b/bundle/configsync/defaults.go
index f28de8098c5..fa07d5b539e 100644
--- a/bundle/configsync/defaults.go
+++ b/bundle/configsync/defaults.go
@@ -90,9 +90,6 @@ var serverSideDefaults = map[string]any{
 	"resources.sql_warehouses.*.min_num_clusters": int64(1),
 	"resources.sql_warehouses.*.warehouse_type":   "CLASSIC",
 
-	// Terraform defaults
-	"resources.jobs.*.run_as": alwaysSkip,
-
 	// deployment.* is CLI-managed: metadata.AnnotateJobs / AnnotatePipelines write
 	// kind + metadata_file_path on every deploy, and the Deployment Metadata Service
 	// sets deployment_id + version_id. None is user-authored (validate.ValidateDeploymentFields
diff --git a/bundle/configsync/diff.go b/bundle/configsync/diff.go
index 37c296e1ffc..afbb33b19ad 100644
--- a/bundle/configsync/diff.go
+++ b/bundle/configsync/diff.go
@@ -162,6 +162,9 @@ func ExtractChanges(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan
 					!keepSkippedRunAsChange(fullPath, changeDesc) {
 					continue
 				}
+				if skipJobRunAs(fullPath, changeDesc, entry.RemoteState) {
+					continue
+				}
 
 				change, err := convertChangeDesc(fullPath, changeDesc)
 				if err != nil {
diff --git a/bundle/configsync/runas.go b/bundle/configsync/runas.go
index 3faea944f41..c0acc6b5ec6 100644
--- a/bundle/configsync/runas.go
+++ b/bundle/configsync/runas.go
@@ -1,15 +1,53 @@
 package configsync
 
-import "github.com/databricks/cli/bundle/deployplan"
+import (
+	"cmp"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
 
 // The plan skips a job's run_as keys that the config lacks as backend defaults.
 // run_as holds a single principal key, so when the remote switches kind (for
 // example user_name to service_principal_name) the new key is the edit itself,
 // and dropping it while removing the old key leaves "run_as: {}".
-const jobRunAsChildPattern = "resources.jobs.*.run_as.*"
+const (
+	jobRunAsPattern      = "resources.jobs.*.run_as"
+	jobRunAsChildPattern = "resources.jobs.*.run_as.*"
+)
 
 // keepSkippedRunAsChange reports whether a run_as change the plan skipped as a
 // backend default should still be considered for syncing.
 func keepSkippedRunAsChange(path string, cd *deployplan.ChangeDesc) bool {
-	return cd.Reason == deployplan.ReasonBackendDefault && matchPattern(jobRunAsChildPattern, path)
+	return cd.Reason == deployplan.ReasonBackendDefault &&
+		(matchPattern(jobRunAsPattern, path) || matchPattern(jobRunAsChildPattern, path))
+}
+
+// skipJobRunAs reports whether a change to the run_as object as a whole must
+// not be synced. The plan diffs a run_as set on both sides key by key, so a
+// change to the whole object means one side has none.
+func skipJobRunAs(path string, cd *deployplan.ChangeDesc, remoteState any) bool {
+	if !matchPattern(jobRunAsPattern, path) {
+		return false
+	}
+	// A removed remote run_as is not synced, as before: the Jobs UI always
+	// submits a principal, and removal is unverified on a real workspace.
+	if cd.Remote == nil {
+		return true
+	}
+	// The config has no run_as. Skip one unchanged since the last deploy.
+	if structdiff.IsEqual(cd.Old, cd.Remote) {
+		return true
+	}
+	return isCreatorRunAs(cd.Remote.(jobs.JobRunAs), remoteState.(*dresources.JobRemote))
+}
+
+// isCreatorRunAs reports whether run_as names the job's creator. Jobs updated by
+// the terraform engine before it was removed carry an explicit run_as set to the
+// job's identity, usually its creator, which is a default rather than an edit:
+// https://github.com/databricks/terraform-provider-databricks/blob/76f95e4/jobs/resource_job.go#L844-L857
+func isCreatorRunAs(runAs jobs.JobRunAs, job *dresources.JobRemote) bool {
+	return cmp.Or(runAs.UserName, runAs.ServicePrincipalName, runAs.GroupName) == job.CreatorUserName
 }
diff --git a/bundle/configsync/runas_test.go b/bundle/configsync/runas_test.go
index 3c1cfbf0f61..c72a2bb2b40 100644
--- a/bundle/configsync/runas_test.go
+++ b/bundle/configsync/runas_test.go
@@ -4,10 +4,16 @@ import (
 	"testing"
 
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
 )
 
-const testRunAsPath = "resources.jobs.my_job.run_as"
+const (
+	testRunAsPath = "resources.jobs.my_job.run_as"
+	testCreator   = "creator@example.com"
+	testSPID      = "11111111-2222-3333-4444-555555555555"
+)
 
 func TestKeepSkippedRunAsChange(t *testing.T) {
 	backendDefault := &deployplan.ChangeDesc{Action: deployplan.Skip, Reason: deployplan.ReasonBackendDefault}
@@ -20,7 +26,7 @@ func TestKeepSkippedRunAsChange(t *testing.T) {
 		{"service_principal_name backend default", testRunAsPath + ".service_principal_name", backendDefault, true},
 		{"user_name backend default", testRunAsPath + ".user_name", backendDefault, true},
 		{"group_name backend default", testRunAsPath + ".group_name", backendDefault, true},
-		{"whole run_as backend default", testRunAsPath, backendDefault, false},
+		{"whole run_as backend default", testRunAsPath, backendDefault, true},
 		{"run_as key already matches the remote", testRunAsPath + ".user_name", &deployplan.ChangeDesc{Action: deployplan.Skip, Reason: deployplan.ReasonRemoteAlreadySet}, false},
 		{"other job field", "resources.jobs.my_job.tasks[task_key='main'].new_cluster.enable_elastic_disk", backendDefault, false},
 		{"pipeline run_as key", "resources.pipelines.my_pipeline.run_as.user_name", backendDefault, false},
@@ -31,3 +37,81 @@ func TestKeepSkippedRunAsChange(t *testing.T) {
 		})
 	}
 }
+
+func TestSkipJobRunAs(t *testing.T) {
+	sp := jobs.JobRunAs{ServicePrincipalName: testSPID}
+	user := jobs.JobRunAs{UserName: "user@example.com"}
+	creator := jobs.JobRunAs{UserName: testCreator}
+	group := jobs.JobRunAs{GroupName: "data-engineers"}
+
+	tests := []struct {
+		name    string
+		path    string
+		cd      *deployplan.ChangeDesc
+		creator string
+		want    bool
+	}{
+		{
+			name:    "service principal set remotely",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Remote: sp},
+			creator: testCreator,
+			want:    false,
+		},
+		{
+			name:    "group set remotely",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Remote: group},
+			creator: testCreator,
+			want:    false,
+		},
+		{
+			name:    "user that is the creator",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Remote: creator},
+			creator: testCreator,
+			want:    true,
+		},
+		{
+			name:    "service principal that is the creator",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Remote: sp},
+			creator: testSPID,
+			want:    true,
+		},
+		{
+			name:    "unchanged since the last deploy",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Old: user, Remote: user},
+			creator: testCreator,
+			want:    true,
+		},
+		{
+			name:    "changed since the last deploy",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Old: user, Remote: sp},
+			creator: testCreator,
+			want:    false,
+		},
+		{
+			name:    "removed remotely",
+			path:    testRunAsPath,
+			cd:      &deployplan.ChangeDesc{Old: user, New: user},
+			creator: testCreator,
+			want:    true,
+		},
+		{
+			name:    "run_as key",
+			path:    testRunAsPath + ".service_principal_name",
+			cd:      &deployplan.ChangeDesc{Remote: testSPID},
+			creator: testSPID,
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			remoteState := &dresources.JobRemote{CreatorUserName: tt.creator}
+			assert.Equal(t, tt.want, skipJobRunAs(tt.path, tt.cd, remoteState))
+		})
+	}
+}