External location Manage permission

[orlandovallejos]

Hi team, I'm trying to update the owner of an external location and I see the following message:

Requires permission MANAGE on external location 'location_name'

The owner of the resource, the user that created it doesn't have that permission? How is that possible?

ok, let's say the owner doesn't have it by default, how I add the MANAGE permission to this resource?

Thanks

[Ashwin_DSA]

Hi @orlandovallejos,

The owner of a Unity Catalog object can do everything with it, including transferring ownership. But Databricks never actually adds MANAGE (or ALL PRIVILEGES) as a grant for the owner. That's why the Permissions tab or SHOW GRANTS won't list MANAGE for them. The Unity Catalog permissions model page explains this.

So the message is about whoever is signed in right now, not about the owner. Only four kinds of users can change an object's owner: the current owner, a metastore admin, the owner of the parent container, or someone with MANAGE on the object. If you aren't signed in as the owner shown in the screenshot, and you aren't a metastore admin, you'll get this error. That's expected. Your screenshot also shows "Automatic: Yes". That usually means the location was set up for you during workspace provisioning, so the owner may not be the person who actually clicked anything.

Here is how you can fix it.

The listed owner or a metastore admin needs to do one of these two things.

They can change the owner directly. In Catalog Explorer, they click the pencil icon next to Owner. Or they can run this in SQL:

ALTER EXTERNAL LOCATION `location_name` OWNER TO `new_owner@company.com`;

Or they can give you MANAGE so you can make the change yourself. They can do this on the location's Permissions tab with Grant > MANAGE, or with this SQL:

GRANT MANAGE ON EXTERNAL LOCATION `location_name` TO `your_user@company.com`;

First, check which user you're signed in as. If it isn't the owner, ask that person or your metastore admin to run one of the commands above. It's a good idea to make a group the owner instead of one person, so you don't hit this again when people change roles. The Manage privileges in Unity Catalog guide walks through transferring ownership step by step.

Hope that helps!

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.

[aayush_410]

The owner of an external location does have the MANAGE permission automatically. It just never shows up in the list of grants, because ownership already implies it. So the error isn’t about the owner. It’s about you, the person trying to change the owner.

To change the owner of an external location, you need to be one of three things: the current owner (or a member of the owner group), someone who has been explicitly granted MANAGE on that location, or a metastore admin. If none of these apply to you, you get that error message.

To fix it, first find out who the current owner is. You can do this by running DESCRIBE EXTERNAL LOCATION location_name; or by opening the location in Catalog Explorer and checking the Details tab.

Then ask the owner, someone in the owner group, or a metastore admin to give you the MANAGE permission. They can do it with this command:

sql
GRANT MANAGE ON EXTERNAL LOCATION location_name TO `your.user@company.com`;

Or through the UI: Catalog, then External Data, then External Locations, then your location, then Permissions, then Grant, and select MANAGE.

Once you have that permission, you can change the owner:

sql
ALTER EXTERNAL LOCATION location_name OWNER TO `new_owner_or_group`;

If you are a metastore admin yourself, you can skip the grant step and run the owner change directly.

A few things to keep in mind. MANAGE lets you grant permissions and change the owner, but it does not give access to the data itself, so you would need to grant READ FILES or WRITE FILES separately if required. It’s better to set a group as the owner instead of one person, so ownership doesn’t break when someone leaves the team. If the original owner has left or their account was deleted, only a metastore admin can sort it out. Finally, having MANAGE on the catalog or schema is not enough; the permission has to be on the external location itself.a

[ShamenParis]

Hi @orlandovallejos , Check the Permissions tab to view access rights. If you can't see the external location permissions, reach out to your admin team. Keep in mind that these permissions are tied to the metastore, not the workspace