Access Logs

[Priyam1]

How can I check the timing when a particular AAD group was given access to a particular schema in a unity catalogue?

Is there any API I can call to get this logs?

[Kaniz]

Hi @Priyam1, To track when a specific Azure Active Directory (AAD) group was granted access to a particular schema in a Unity Catalog, you have a few options:

1. Unity Catalog Privileges and Access Control:

   • Unity Catalog allows you to control access to data and other objects within it.
   • You can set access controls using:
     • Catalog Explorer: A user interface (UI) for managing permissions.
     • SQL statements in notebooks or Databricks SQL queries.
     • The Unity Catalog REST API.
     • Terraform.
   • Initially, users have no access to data in a metastore. Access can be granted by:
     • A metastore admin.
     • The owner of an object.
     • The owner of the catalog or schema containing the object.
   • Privilege Inheritance: Access privileges are inherited downward, meaning granting a privilege on the...¹.
   • Basic object privileges include SHOW, GRANT, and REVOKE commands for managing privileges on catalogs...¹.
   • To transfer ownership of an object, you can use SQL or Catalog Explorer¹.

2. Metastore Admin Role Assignment:

   • As an account admin, you can assign the metastore admin role to a group:
     • Log in to the account console.
     • Click Catalog.
     • Open the properties of the desired metastore.
     • Under Metastore Admin, click Edit.
     • Select a group from the dropdown and save the changes².

3. SQL Commands:

   • You can use SQL commands to grant access to specific groups:
     • GRANT USE CATALOG ON CATALOG <catalog_name> TO <group_name>;
     • GRANT USE SCHEMA ON SCHEMA <catalog_name>.<schema_name> TO <group_name>;
     • GRANT SELECT ON <catalog_name>.<schema_name>.<table_name> TO <group_name>;³.

4. Unity Catalog in the Enterprise:

   • Unity Catalog has a subscription-wide view and can grant access for AAD security groups into one or ...⁴.
   • If you need further assistance, feel free to ask! 🚀

[Priyam1]

All of these aforementioned solutions are to grant access but I want to check the timing when an AAD group was given access to a schema and when the group was removed from the schema.

Thanks again