Turning on audit logging

Unity Catalog automatically captures audit events for data access, permission changes, and administrative actions across catalogs, schemas, and tables. Administrators can access these logs either through Azure Diagnostic settings exported to Log Analytics/Storage/Event Hubs, or by querying the built-in system.access.audit system table directly with SQL.

1 · Learn the must-know

• 1Unity Catalog audit events are logged automatically for actions like table reads, grants/revokes, and catalog/schema changes without any extra instrumentation by the user.
• 2In Azure, audit logs are enabled by configuring Diagnostic settings on the Azure Databricks workspace resource and selecting relevant log categories (e.g., unityCatalog, account) to route to a Log Analytics workspace, Storage Account, or Event Hub.
• 3The system.access.audit system table provides a queryable, SQL-native view of audit logs and must be explicitly enabled by a metastore admin because system schemas are disabled by default.
• 4Audit log records include fields such as serviceName, actionName, requestParams, userIdentity, and sourceIPAddress, useful for tracing who did what and when.
• 5Configuring diagnostic log export requires Azure-level permissions (e.g., Owner/Contributor on the workspace resource), which is distinct from Unity Catalog metastore admin permissions needed to enable system tables.
• 6Audit logging is metastore-wide (account-level) in Unity Catalog, so a single configuration captures activity across all workspaces attached to that metastore, not per-workspace.

2 · Check your understanding