diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/.databrickscfg b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/.databrickscfg
new file mode 100644
index 000000000..405e344a0
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/.databrickscfg
@@ -0,0 +1,3 @@
+[someprofile]
+host = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/databricks.yml b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/databricks.yml
similarity index 100%
rename from acceptance/bundle/exec/databricks-cli/profile-is-passed/databricks.yml
rename to acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/databricks.yml
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/out.requests.txt b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/out.requests.txt
new file mode 100644
index 000000000..c4a103482
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/out.requests.txt
@@ -0,0 +1,9 @@
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/output.txt b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/output.txt
new file mode 100644
index 000000000..8ca3fe8c5
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle exec -- [CLI] current-user me
+{
+  "id":"[USERID]",
+  "userName":"[USERNAME]"
+}
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/script b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/script
similarity index 68%
rename from acceptance/bundle/exec/databricks-cli/profile-is-passed/script
rename to acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/script
index 33e07494c..a614758e5 100644
--- a/acceptance/bundle/exec/databricks-cli/profile-is-passed/script
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_bundle/script
@@ -1,5 +1,4 @@
 # Replace placeholder with an actual host URL
-envsubst < databricks.yml > out.yml && mv out.yml databricks.yml
 envsubst < .databrickscfg > out && mv out .databrickscfg
 export DATABRICKS_CONFIG_FILE=.databrickscfg
 
@@ -9,6 +8,3 @@ unset DATABRICKS_TOKEN
 
 # This should use the profile configured in the bundle, i.e. PAT auth
 trace $CLI bundle exec -- $CLI current-user me
-
-# This should use myprofile, which uses oauth.
-trace $CLI bundle exec --profile myprofile -- $CLI current-user me
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/.databrickscfg b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/.databrickscfg
similarity index 100%
rename from acceptance/bundle/exec/databricks-cli/profile-is-passed/.databrickscfg
rename to acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/.databrickscfg
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/databricks.yml b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/databricks.yml
new file mode 100644
index 000000000..5de7d1d96
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: foobar
+
+workspace:
+  profile: someprofile
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/out.requests.txt b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/out.requests.txt
similarity index 78%
rename from acceptance/bundle/exec/databricks-cli/profile-is-passed/out.requests.txt
rename to acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/out.requests.txt
index 2b214d4fd..bbad66cf8 100644
--- a/acceptance/bundle/exec/databricks-cli/profile-is-passed/out.requests.txt
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/out.requests.txt
@@ -1,11 +1,6 @@
 {
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
   "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
+  "path": "/oidc/.well-known/oauth-authorization-server"
 }
 {
   "method": "GET",
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/output.txt b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/output.txt
similarity index 54%
rename from acceptance/bundle/exec/databricks-cli/profile-is-passed/output.txt
rename to acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/output.txt
index 06cdd1c44..30463a78f 100644
--- a/acceptance/bundle/exec/databricks-cli/profile-is-passed/output.txt
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/output.txt
@@ -1,10 +1,4 @@
 
->>> [CLI] bundle exec -- [CLI] current-user me
-{
-  "id":"[USERID]",
-  "userName":"[USERNAME]"
-}
-
 >>> [CLI] bundle exec --profile myprofile -- [CLI] current-user me
 {
   "id":"[USERID]",
diff --git a/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/script b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/script
new file mode 100644
index 000000000..7d0124c0a
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/profile-is-passed/from_flag/script
@@ -0,0 +1,10 @@
+# Replace placeholder with an actual host URL
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+# Credentials will be picked up from .databrickscfg. Unset existing credentials.
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+
+# This should use myprofile, which uses oauth.
+trace $CLI bundle exec --profile myprofile -- $CLI current-user me
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/default/.databrickscfg b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/.databrickscfg
new file mode 100644
index 000000000..dbf302e9c
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/.databrickscfg
@@ -0,0 +1,8 @@
+[pat-profile]
+host = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[oauth-profile]
+host = $DATABRICKS_HOST
+client_id = client_id
+client_secret = client_secret
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/databricks.yml b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/databricks.yml
similarity index 53%
rename from acceptance/bundle/exec/databricks-cli/target-is-passed/databricks.yml
rename to acceptance/bundle/exec/databricks-cli/target-is-passed/default/databricks.yml
index 6b782c325..7f808c24b 100644
--- a/acceptance/bundle/exec/databricks-cli/target-is-passed/databricks.yml
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/databricks.yml
@@ -4,7 +4,9 @@ bundle:
 targets:
   pat:
     default: true
+    workspace:
+      profile: pat-profile
 
   oauth:
     workspace:
-      client_id: client_id
+      profile: oauth-profile
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/default/out.requests.txt b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/out.requests.txt
new file mode 100644
index 000000000..c4a103482
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/out.requests.txt
@@ -0,0 +1,9 @@
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/default/output.txt b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/output.txt
new file mode 100644
index 000000000..8ca3fe8c5
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle exec -- [CLI] current-user me
+{
+  "id":"[USERID]",
+  "userName":"[USERNAME]"
+}
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/default/script b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/script
new file mode 100644
index 000000000..4b036659d
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/default/script
@@ -0,0 +1,10 @@
+# Replace placeholder with an actual host URL
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+# Credentials will be picked up from .databrickscfg. Unset existing credentials.
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+
+# Should use default target, which is bat based authentication
+trace $CLI bundle exec -- $CLI current-user me
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/.databrickscfg b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/.databrickscfg
new file mode 100644
index 000000000..dbf302e9c
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/.databrickscfg
@@ -0,0 +1,8 @@
+[pat-profile]
+host = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[oauth-profile]
+host = $DATABRICKS_HOST
+client_id = client_id
+client_secret = client_secret
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/databricks.yml b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/databricks.yml
new file mode 100644
index 000000000..7f808c24b
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: foobar
+
+targets:
+  pat:
+    default: true
+    workspace:
+      profile: pat-profile
+
+  oauth:
+    workspace:
+      profile: oauth-profile
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/out.requests.txt b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/out.requests.txt
similarity index 61%
rename from acceptance/bundle/exec/databricks-cli/target-is-passed/out.requests.txt
rename to acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/out.requests.txt
index 26efbbb08..bbad66cf8 100644
--- a/acceptance/bundle/exec/databricks-cli/target-is-passed/out.requests.txt
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/out.requests.txt
@@ -1,20 +1,6 @@
 {
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
   "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
+  "path": "/oidc/.well-known/oauth-authorization-server"
 }
 {
   "method": "GET",
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/output.txt b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/output.txt
new file mode 100644
index 000000000..828868f10
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle exec -t oauth -- [CLI] current-user me
+{
+  "id":"[USERID]",
+  "userName":"[USERNAME]"
+}
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/script b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/script
new file mode 100644
index 000000000..58a407a10
--- /dev/null
+++ b/acceptance/bundle/exec/databricks-cli/target-is-passed/from_flag/script
@@ -0,0 +1,10 @@
+# Replace placeholder with an actual host URL
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+# Credentials will be picked up from .databrickscfg. Unset existing credentials.
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+
+# Explicitly select oauth target
+trace $CLI bundle exec -t oauth -- $CLI current-user me
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/output.txt b/acceptance/bundle/exec/databricks-cli/target-is-passed/output.txt
deleted file mode 100644
index 0751ac7dc..000000000
--- a/acceptance/bundle/exec/databricks-cli/target-is-passed/output.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-
->>> [CLI] bundle exec -- [CLI] current-user me
-{
-  "id":"[USERID]",
-  "userName":"[USERNAME]"
-}
-
->>> [CLI] bundle exec -t pat -- [CLI] current-user me
-{
-  "id":"[USERID]",
-  "userName":"[USERNAME]"
-}
-
->>> errcode [CLI] bundle exec -t pat -- [CLI] current-user me -t oauth
-Error: cannot resolve bundle auth configuration: validate: more than one authorization method configured: oauth and pat. Config: host=[DATABRICKS_URL], token=***, client_id=client_id, databricks_cli_path=[CLI]. Env: DATABRICKS_HOST, DATABRICKS_TOKEN, DATABRICKS_CLI_PATH
-Error: running "[CLI] current-user me -t oauth" failed with exit code: 1
-
-Exit code: 1
-
->>> [CLI] bundle exec -t oauth -- [CLI] current-user me
-{
-  "id":"[USERID]",
-  "userName":"[USERNAME]"
-}
diff --git a/acceptance/bundle/exec/databricks-cli/target-is-passed/script b/acceptance/bundle/exec/databricks-cli/target-is-passed/script
deleted file mode 100644
index 238c36ae4..000000000
--- a/acceptance/bundle/exec/databricks-cli/target-is-passed/script
+++ /dev/null
@@ -1,15 +0,0 @@
-# Default target
-trace $CLI bundle exec -- $CLI current-user me
-
-# Explicitly select default target
-trace $CLI bundle exec -t pat -- $CLI current-user me
-
-# Conflicting targets selected. This should fail because for the child command
-# pat would be configured via environment variables and oauth via the CLI resulting
-# in more than one authorization method configured.
-trace errcode $CLI bundle exec -t pat -- $CLI current-user me -t oauth
-
-# Explicitly select oauth target
-unset DATABRICKS_TOKEN
-export DATABRICKS_CLIENT_SECRET="client_secret"
-trace $CLI bundle exec -t oauth -- $CLI current-user me