Permissions and access requirements

Use this topic to verify the Unity Catalog privileges and Azure storage roles that the source and target service principals require. These permissions are required for the connector to work correctly with the Databricks environment.

Unity Catalog privileges

Grant the following privileges to the source and target Service Principals (SP)

Securable	Privilege	Source SP	Target SP	Purpose
Catalog	USE CATALOG	Yes	Yes	Traverse the catalog
Schema	USE SCHEMA	Yes	Yes	Traverse the schema
Table	SELECT or BROWSE	Yes	Yes	Read table metadata and data
Table	Ownership (IS OWNER)	No	Yes	Disable and re-enable Predictive Optimizer on the target table
SQL Warehouse	CAN USE	No	Yes	Run ALTER TABLE ... PREDICTIVE OPTIMIZATION DDL

Source table data is masked and then written to the corresponding target tables. The target service principal requires Ownership permission only on those target tables (so it can enable or disable Predictive Optimization, an action limited to a table's owner or Ownership Group). Source tables require no Ownership or other special permissions.

 

Azure storage roles

Assign the following Azure RBAC roles at the appropriate storage scope.

Role scope	Azure RBAC role	Source SP	Target SP
Source storage account or container	Storage Blob Data Reader	Yes	No
Target storage account or container	Storage Blob Data Contributor	No	Yes