Unity Catalog - Can i delete system tags?

[NoobMaster69]

It says here that "Users cannot modify or delete system tag keys or values".

Is there absolutely no way to delete system tags? Even as an administrator? 

Apply tags to Unity Catalog securable objects | Databricks on AWS

[hayoni]

Hello @NoobMaster69 

Based on the official docs, Just to clarify, there are two different things going on here

https://docs.databricks.com/aws/en/database-objects/tags

You can't delete the tag definition itself

> "Users cannot modify or delete system tag keys or values."

System tags are built-in defaults by Databricks, so even admins can't edit or delete the tag keys/values.

You can still remove (unset) it from your object

> "To add a governed tag to Unity Catalog securable objects, you must also have the ASSIGN permission on the governed tag."

> "Users can control who is allowed to assign or unassign system tags through governed tag permission settings."

because system tags are treated as Governed Tags, owning the table or having APPLY TAG isn't enough. You specifically need the ASSIGN permission on that tag to remove it.

To fix this

you'll need an Account Admin (workspace admin won't be enough) to grant you the ASSIGN permission on the tag.

https://docs.databricks.com/aws/en/admin/governed-tags/manage-permissions

If you want to check your admin role types, see: https://docs.databricks.com/aws/en/admin/admin-concepts

Hope this helps!

[balajij8]

@NoobMaster69 

There is no workaround and system tags cannot be modified or deleted even if you have Meta store Admin or Account Admin privileges.

System tags (identified by the system. prefix) are platform managed metadata maintained entirely by Databricks. They are designed to be strictly immutable to protect internal platform functionality, track system state and maintain consistent metadata behavior across the meta store.

If you need tags that you can create, update and delete for catalog organization or data governance, you can use user-managed tags as below

• Governed tags - Custom tags backed by tag policies you can define and control. It allows administrators to enforce allowed value constraints and manage their lifecycle (create, alter or drop).
• Free-form tags - Standard user-defined key-value tags without predefined constraints that can be applied, updated or removed by object owners or users granted the necessary tag permissions.

[AbhilashNagilla]

No, if you mean the system tag definition. The permissions documentation says system tags cannot be updated or deleted, even by someone with MANAGE.

The tag assignment on an object can be removed. On an object type supported by SQL, the caller needs both ASSIGN on the system tag and the object-side UNSET TAG permissions: object ownership, or APPLY TAG plus the applicable parent privileges.

Account Admins have account-level ASSIGN by default, and ASSIGN can be delegated: a principal with account-level MANAGE can grant it across the account, and a principal with MANAGE on an individual governed tag can grant it for that tag. So removing the assignment does not require an Account Admin.