Databricks Exclusive Access

[saurabh18cs]

I’m exploring how to set up exclusive access for separate use cases implementation within a shared Databricks workspace, using Microsoft Entra groups and Unity Catalog. I’d love to hear from anyone who has implemented something similar, or is currently working through the same questions.

A few things I’m trying to understand:

• How have you structured Unity Catalog privileges to keep use cases isolated while allowing catalog admins to manage the catalog?
• Have you delegated schema-level permission management to use-case owners? What worked well, and what should we watch out for?

[suranga]

Hi @saurabh18cs,

This is one of those setups where it really pays to settle the pattern early, before there are hundreds of grants to untangle. Here's how I'd structure it:

1. Account groups only. Sync the Entra groups into the Databricks account (automatic identity management or SCIM) and grant to those. Workspace-local groups can't be granted access to Unity Catalog data at all, so they're a dead end here.

2. A few groups per use case, for example uc_sales_owners, uc_sales_writers and uc_sales_readers. Make groups the owners of things, never individual people, so nothing breaks when someone leaves.

3. Keep the catalog with the platform team and delegate at schema level. The catalog admin group owns the catalog. Each use case gets USE CATALOG on the catalog plus MANAGE on its own schema. MANAGE lets the use-case owners handle grants inside their schema without being the owner, and they can't touch anything else in the catalog:

GRANT USE CATALOG ON CATALOG analytics TO `uc_sales_owners`;
GRANT MANAGE, USE SCHEMA, CREATE TABLE ON SCHEMA analytics.sales TO `uc_sales_owners`;

Things to watch out for:

• Privileges inherit downwards. A SELECT granted on the catalog applies to every schema in it, so give use-case groups nothing on the catalog except USE CATALOG (and BROWSE if you want people to discover other datasets without being able to read them).
• Delegation means trust. Someone with MANAGE on a schema can grant it to any group, including other use cases. Agree the rules up front and check system.access.audit now and then.
• If use cases also need separate storage, give each schema its own managed location, and keep external locations and storage credentials with the platform team.
• Unity Catalog doesn't cover workspace objects. Notebooks, jobs, clusters and warehouses have their own permissions, so mirror the same groups there (a folder per use case, cluster policies per group).
• If a use case needs harder separation than a schema in a shared catalog, a catalog per use case bound to specific workspaces is the next step up.

Hope that helps. Happy to compare notes if you run into something specific.

Cheers,
Suranga