Granting Unity Catalog privileges to users, service principals, and groups

In Unity Catalog, access to securable objects (metastore, catalog, schema, table, view, volume, function, etc.) is controlled by granting privileges to principals using the GRANT SQL command or the Catalog Explorer UI. Privileges cascade down the object hierarchy, so granting at a higher level (e.g., catalog) implicitly applies to child objects (schemas, tables) unless explicitly restricted.

1 · Learn the must-know

• 1Use GRANT <privilege> ON <securable_type> <name> TO <principal> to assign rights; use REVOKE to remove them and SHOW GRANTS ON <securable> to audit current permissions.
• 2To query a table, a principal needs USE CATALOG and USE SCHEMA on the parent catalog/schema plus SELECT on the table itself—missing any link in the chain blocks access.
• 3Only the object owner or a metastore admin (or a principal with the MANAGE privilege) can grant or revoke privileges on that object; ownership can be transferred with ALTER ... OWNER TO.
• 4Privileges can be granted to account-level users, service principals, or groups; Databricks recommends granting to groups rather than individual users for easier governance at scale.
• 5Common privileges include USE CATALOG, USE SCHEMA, CREATE TABLE, CREATE FUNCTION, SELECT, MODIFY, EXECUTE, and ALL PRIVILEGES, each scoped to the object type it applies to.
• 6Privilege inheritance flows one-way down the hierarchy (metastore → catalog → schema → table/view); granting on a child object does not grant access to its parent.

2 · Check your understanding