topic Re: get permissions assignment done from the workspaces UI in Administration & Architecture

get permissions assignment done from the workspaces UI

noorbasha534 — Wed, 09 Apr 2025 22:56:43 GMT

Hi all,

I am looking to capture events of permissions assigned on catalog/schemas/tables/views from the workspaces UI; example, someone gave another user USE CATALOG permission from the UI.

Is it possible to capture all such events?

appreciate the mindshare

Re: get permissions assignment done from the workspaces UI

Advika — Thu, 10 Apr 2025 12:52:58 GMT

Hello @noorbasha534!

Yes, it's possible to capture permission-related events made through the Databricks workspace UI using Unity Catalog audit logs. These logs automatically track such actions at the account level. To capture these events, make sure audit logging is enabled for your account and a delivery location is configured.

For more details: Audit Unity Catalog events

Re: get permissions assignment done from the workspaces UI

noorbasha534 — Thu, 10 Apr 2025 15:11:51 GMT

@Advika can you kindly please let me know the action name that I should filter upon...

Re: get permissions assignment done from the workspaces UI

Advika — Fri, 11 Apr 2025 10:27:51 GMT

@noorbasha534, you can use the action_name field to filter specific types of events. For example, to track permission changes—such as grants or revokes on catalogues, schemas, tables, or views, you can filter by updatePermissions. That said, the exact action name depends on the type of event you're trying to track.

Re: get permissions assignment done from the workspaces UI

noorbasha534 — Sat, 12 Apr 2025 21:00:24 GMT

@Advika Hi Advika, thanks much for your time in replying. we do the same currently. However, please note we as admins give permissions via an automatically generated notebook ((permissions come from Git and the CI/CD pipeline generates notebooks)). Therefore, our IDs are also appearing in that action results. One thing we notice for those who give permissions from the UI - the user_agent column contains the browser name like 'Mozilla * Chrome'.

If there is a fool-proof way, request you kindly please investigate and share with us. Highly appreciate as we have controls internally we have to meet. Admins are giving permissions via UI; also, there are so many limitations with current Databricks permissions model - we want developers to be schema owners but do not expect them to give permissions, and owners can give permissions at the moment. We are discussing these with Databricks RSA anyways.