topic Re: When setting up unity catalog a storage account was created with security risk in Administration & Architecture

When setting up unity catalog a storage account was created with security risk

howardgagan — Wed, 24 Sep 2025 13:40:58 GMT

When i set up databricks unity catalog, i think it automatically set up a storage account. I'm getting recommendations from Azure that this storage account has high risk associated with it.

The problem is this resource has a deny assignment on preventing me making any changes. Is this something that is added at creation from databricks? Is so should the high risk level recommendation be ignored?

Have anyone dealt with this situation, what the best steps to take here?

Re: When setting up unity catalog a storage account was created with security risk

nayan_wylde — Wed, 24 Sep 2025 16:21:50 GMT

It is a recommendation. Azure advises not to use SAS keys to connect to the strorage. The recommendation is to use Managed Identity or SPN to access the storage and SPN keys to be used in keyvault. But with UC the connection is made using Azure Databricks storage connector which is similar to managed identity.

Re: When setting up unity catalog a storage account was created with security risk

szymon_dybczak — Wed, 24 Sep 2025 20:21:35 GMT

Hi @howardgagan ,

Each Azure Databricks workspace has an associated Azure storage account in a managed resource group known as the workspace storage account.
This storage account includes workspace system data (job output, system settings, and logs), DBFS root etc.

Good news is that you don't need to and even you shouldn't store your data on that managed storage account. The recommendation is to use Unity Catalog with your own storage account (and here you have full control how to configure it)

You can try to improve your security risk score by enabling firewall support for this workspace storage account. You can read how to do this at below link:

Enable firewall support for your workspace storage account - Azure Databricks | Microsoft Learn

In case of preventing shared access key support - here you need to ignore this risk assessment, because you can't change any setting within managed resource group