https://community.databricks.com/t5/administration-architecture/obtain-access-of-azure-metastore-storage-account-to-configure/m-p/82281#M1530 <P>Thanks for your response,&nbsp;<a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/9">@Retired_mod</a>. I already have Unity Catalog configured using an access connector and managed identity, these were automatically created by the Databricks workspace initialisation. The issue I'm facing is that [Azure Blob Lifecycle Management Policies](<A href="https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal#create-or-manage-a-policy" target="_blank">https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal#create-or-manage-a-policy</A>) require access to the storage container, but I am prevented from doing this by the Deny assignment.</P><P>I have tried</P><UL><LI>logging in as the managed identity that has access to the storage container, but the managed identity is also blocked by a Deny assignment.</LI><LI>creating another managed identity with access to the storage container, but the resource group is blocked by a Deny assignment</LI></UL><P>I want to know if there is a way around these Deny assignments as an administrator.</P> Wed, 07 Aug 2024 21:38:04 GMT heathwinning 2024-08-07T21:38:04Z https://community.databricks.com/t5/administration-architecture/obtain-access-of-azure-metastore-storage-account-to-configure/m-p/81561#M1454 <P>I recently set up an Azure Databricks workspace with an automatically created metastore and metastore-level root storage within the <STRONG>metastore blob storage account</STRONG>. All the catalogs, schemas, and tables/volumes have been created without a specified or external location, so the data all reside in the <STRONG>metastore blob storage account</STRONG>&nbsp;under the container named "unity-catalog-storage".</P><P>Because of the "<SPAN>System deny assignment created by Azure Databricks" I have no direct access to the&nbsp;<STRONG>metastore blob storage account</STRONG>, and therefore cannot set the access tier of some large raw files to Cool, nor can I create lifecycle management policies to do this automatically.</SPAN></P><P><SPAN>I regret not setting up a separate storage account for catalogs, but if possible I'd love to avoid risking migration of lots of data in lots of tables. Is there a way to achieve the access required to configure Lifecycle management?</SPAN></P> Fri, 02 Aug 2024 00:13:15 GMT https://community.databricks.com/t5/administration-architecture/obtain-access-of-azure-metastore-storage-account-to-configure/m-p/81561#M1454 heathwinning 2024-08-02T00:13:15Z https://community.databricks.com/t5/administration-architecture/obtain-access-of-azure-metastore-storage-account-to-configure/m-p/82281#M1530 <P>Thanks for your response,&nbsp;<a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/9">@Retired_mod</a>. I already have Unity Catalog configured using an access connector and managed identity, these were automatically created by the Databricks workspace initialisation. The issue I'm facing is that [Azure Blob Lifecycle Management Policies](<A href="https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal#create-or-manage-a-policy" target="_blank">https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal#create-or-manage-a-policy</A>) require access to the storage container, but I am prevented from doing this by the Deny assignment.</P><P>I have tried</P><UL><LI>logging in as the managed identity that has access to the storage container, but the managed identity is also blocked by a Deny assignment.</LI><LI>creating another managed identity with access to the storage container, but the resource group is blocked by a Deny assignment</LI></UL><P>I want to know if there is a way around these Deny assignments as an administrator.</P> Wed, 07 Aug 2024 21:38:04 GMT https://community.databricks.com/t5/administration-architecture/obtain-access-of-azure-metastore-storage-account-to-configure/m-p/82281#M1530 heathwinning 2024-08-07T21:38:04Z