Authenticating resource access with managed identities

Unity Catalog uses managed identities (via access connectors) to authenticate to cloud storage instead of storing secrets or service principal credentials. This is the recommended, credential-free way for Databricks to access ADLS Gen2 storage accounts securely, and it underlies storage credentials used by external locations and metastores.

1 · Learn the must-know

• 1An Azure Databricks Access Connector is an Azure resource that hosts a managed identity used to authenticate Unity Catalog to ADLS Gen2 storage.
• 2In Unity Catalog, a storage credential object wraps the access connector's managed identity and is what external locations and the metastore reference to access cloud storage.
• 3The managed identity (via the access connector) must be granted appropriate RBAC roles, such as Storage Blob Data Contributor, on the target storage account or container.
• 4Using managed identities avoids storing and rotating secrets like service principal client secrets or account keys, improving security posture.
• 5Access connectors can be scoped to a single storage account or used broadly across multiple storage credentials, depending on how the admin configures RBAC assignments.
• 6Only Databricks/Unity Catalog admins with sufficient Azure permissions (e.g., Owner or User Access Administrator) can create access connectors and assign the required RBAC roles.

2 · Check your understanding