You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/administer-unity-catalog/includes/2-implement-isolation-methods.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ Administrative isolation ensures that no single person or workspace has unrestri
8
8
9
9
|**Role**|**Responsibilities**|**Scope**|
10
10
|-----------|----------------------|------------|
11
-
|**Account Admin**| Manage the Azure Databricks account, including enabling Unity Catalog, user provisioning, and account-level identity management. | Entire Databricks account |
11
+
|**Account Admin**| Manage the Azure Databricks account, including enabling Unity Catalog, user provisioning, and account-level identity management. | Entire Azure Databricks account |
12
12
|**Metastore Admin**| Manage privileges and ownership for all securable objects within a Unity Catalog metastore, such as who can create catalogs or query a table. | Specific metastore |
13
13
14
14
## Explore isolation boundary types
@@ -31,7 +31,7 @@ Workspace-to-catalog binding **controls where data is used** by restricting cata
31
31
32
32
**To implement workspace-to-catalog binding:**
33
33
34
-
1. In the Databricks workspace, select **Catalog**.
34
+
1. In the Azure Databricks workspace, select **Catalog**.
35
35
2. In the **Catalog** pane, select the catalog you want to bind.
36
36
3. On the **Workspaces** tab, clear the **All workspaces have access** checkbox.
37
37
4. Select **Assign to workspaces** and select the specific workspaces that should have access.
In modern data platforms, granting or denying access to entire tables is rarely sufficient to meet real-world security and governance needs. Organizations must often expose only a subset of data, protecting sensitive information while maintaining analytical utility. Databricks Unity Catalog provides robust **fine-grained access control** mechanisms that allow you to manage data visibility at the row and column level without duplicating datasets or creating unnecessary complexity.
1
+
In modern data platforms, granting or denying access to entire tables is rarely sufficient to meet real-world security and governance needs. Organizations must often expose only a subset of data, protecting sensitive information while maintaining analytical utility. Azure Databricks Unity Catalog provides robust **fine-grained access control** mechanisms that allow you to manage data visibility at the row and column level without duplicating datasets or creating unnecessary complexity.
2
2
3
3
In this module, you'll explore the two primary approaches—**Row and Column Security** and **Dynamic Views**—understand when to use each, and see why modern architectures favor table-level controls. You'll also learn how **Lakehouse Monitoring** supports ongoing data quality and model performance tracking, ensuring that your lakehouse remains secure, reliable, and transparent as data evolves.
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/implement-advanced-security-unity-catalog/includes/2-understand-fine-grained-access-control.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ Key characteristics you should internalize:
38
38
39
39
## Dynamic Views
40
40
41
-
Dynamic Views predate Row and Column Security. These have been with Databricks for some time, and though they're no longer the preferred method for controlling access to rows and columns, they still have their place. You define a view that selects from one or more underlying tables and encodes conditional logic: CASE expressions to mask sensitive columns, predicates to exclude rows, or transformations that partially obfuscate values. Any user with permission on the view can query it without having direct access to the underlying tables, assuming the view owner has that access. This separation lets you shield source objects while presenting a curated projection.
41
+
Dynamic Views predate Row and Column Security. These have been with Azure Databricks for some time, and though they're no longer the preferred method for controlling access to rows and columns, they still have their place. You define a view that selects from one or more underlying tables and encodes conditional logic: CASE expressions to mask sensitive columns, predicates to exclude rows, or transformations that partially obfuscate values. Any user with permission on the view can query it without having direct access to the underlying tables, assuming the view owner has that access. This separation lets you shield source objects while presenting a curated projection.
42
42
43
43

Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/implement-advanced-security-unity-catalog/includes/5-understand-lakehouse-monitoring.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,4 +1,4 @@
1
-
Lakehouse Monitoring in Databricks provides a way to continuously assess the quality of data and the performance of machine learning models within your environment. By attaching monitors to tables or inference logs, you can track changes in data distributions, detect drift, and evaluate model performance over time. This monitoring capability ensures that data-driven applications remain reliable, transparent, and easy to diagnose when issues arise.
1
+
Lakehouse Monitoring in Azure Databricks provides a way to continuously assess the quality of data and the performance of machine learning models within your environment. By attaching monitors to tables or inference logs, you can track changes in data distributions, detect drift, and evaluate model performance over time. This monitoring capability ensures that data-driven applications remain reliable, transparent, and easy to diagnose when issues arise.
2
2
3
3
## What is Lakehouse Monitoring?
4
4
@@ -10,7 +10,7 @@ Lakehouse Monitoring is designed to help data practitioners and consumers unders
10
10
11
11
-**Inference analysis**: Focuses on tables that store model inputs and predictions, allowing you to measure model drift and performance over time.
12
12
13
-
Once a monitor is created, Databricks automatically generates metric tables and a dashboard that summarize the results. This makes it possible to examine statistics, visualize changes, and configure alerts when thresholds are exceeded.
13
+
Once a monitor is created, Azure Databricks automatically generates metric tables and a dashboard that summarize the results. This makes it possible to examine statistics, visualize changes, and configure alerts when thresholds are exceeded.
14
14
15
15
## Why Monitor Data and Models?
16
16
@@ -35,7 +35,7 @@ When you set up monitoring, several components work together to provide visibili
35
35
-**Metric tables**: Two types of metric tables are created:
36
36
- A **profile metrics table**, which stores summary statistics about the dataset.
37
37
- A **drift metrics table**, which captures changes in the distribution of the data compared to previous time windows or a baseline.
38
-
-**Dashboard**: Automatically generated in Databricks, the dashboard visualizes the results from the metric tables. It supports filtering by time range, column, and slice of data, and can be extended with SQL alerts.
38
+
-**Dashboard**: Automatically generated in Azure Databricks, the dashboard visualizes the results from the metric tables. It supports filtering by time range, column, and slice of data, and can be extended with SQL alerts.
39
39
40
40
## Typical Use Cases
41
41
@@ -47,4 +47,4 @@ Beyond data quality, monitoring also contributes to **model stability** by compa
47
47
48
48
Dashboards generated by Lakehouse Monitoring provide visual access to metrics such as row counts, null percentages, and drift statistics. They can be filtered by time ranges and subsets of data to better understand specific trends.
49
49
50
-
In addition, Databricks allows you to set up alerts based on metric thresholds. For instance, you might configure an alert to notify you when the proportion of nulls in a column exceeds 20%, or when the F1 score of a model drops below a set level. These proactive alerts allow teams to respond quickly rather than waiting for downstream failures to surface.
50
+
In addition, Azure Databricks allows you to set up alerts based on metric thresholds. For instance, you might configure an alert to notify you when the proportion of nulls in a column exceeds 20%, or when the F1 score of a model drops below a set level. These proactive alerts allow teams to respond quickly rather than waiting for downstream failures to surface.
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/understand-unity-catalog/6-knowledge-check.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ quiz:
18
18
choices:
19
19
- content: "To provide distributed computing for big data processing"
20
20
isCorrect: false
21
-
explanation: "Incorrect. Unity Catalog is not used for distributed computing; that's the role of Apache Spark in Databricks."
21
+
explanation: "Incorrect. Unity Catalog is not used for distributed computing; that's the role of Apache Spark in Azure Databricks."
22
22
- content: "To provide unified data governance across all workspaces"
23
23
isCorrect: true
24
24
explanation: "Correct. Unity Catalog provides a centralized governance layer that spans all Azure Databricks workspaces, enabling consistent permissions, auditing, and data management."
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/understand-unity-catalog/includes/2-explore-data-governance.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,4 +29,4 @@ Unity Catalog automatically logs access events into system tables, making it eas
29
29
30
30
### Federated governance
31
31
32
-
Unity Catalog extends governance beyond Databricks-managed data by supporting connections to external systems through **connections** and **foreign catalogs**. This allows organizations to apply the same access controls and auditing, even when data stays in place outside of Databricks.
32
+
Unity Catalog extends governance beyond Azure Databricks-managed data by supporting connections to external systems through **connections** and **foreign catalogs**. This allows organizations to apply the same access controls and auditing, even when data stays in place outside of Azure Databricks.
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/understand-unity-catalog/includes/3-analyze-unity-catalog-architecture.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ Each Azure Databricks account has one metastore per Azure region, ensuring that
6
6
7
7
## Understand metastore fundamentals
8
8
9
-
Before Unity Catalog, each workspace in Databricks had its own Hive metastore, and permissions had to be managed separately.
9
+
Before Unity Catalog, each workspace in Azure Databricks had its own Hive metastore, and permissions had to be managed separately.
10
10
With Unity Catalog, workspaces in the same region share a single metastore. This design centralizes governance while maintaining compliance with regional boundaries—for example, all **East US** workspaces share one metastore, while all **West Europe** workspaces share another.
Copy file name to clipboardExpand all lines: learn-pr/wwl-data-ai/understand-unity-catalog/includes/4-explore-external-data.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,24 +1,24 @@
1
-
Unity Catalog can govern data that lives outside Databricks—whether in cloud storage like Azure Data Lake Storage or in operational databases. This capability solves a common challenge: you have valuable data in multiple systems, and you need to query it without duplicating everything into Databricks.
1
+
Unity Catalog can govern data that lives outside Azure Databricks—whether in cloud storage like Azure Data Lake Storage or in operational databases. This capability solves a common challenge: you have valuable data in multiple systems, and you need to query it without duplicating everything into Azure Databricks.
2
2
3
3
This unit covers three ways Unity Catalog extends governance to external data:
4
4
5
5
-**External storage** – Govern access to data files in cloud storage like Azure Data Lake Storage, through storage credentials and external locations
6
6
-**Lakehouse Federation** – Query operational databases without moving data
7
7
-**Delta Sharing** – Securely share governed datasets with other organizations or workspaces
8
8
9
-
All three approaches maintain Unity Catalog's governance model: access control, auditing, and lineage tracking work the same whether data lives inside or outside Databricks.
9
+
All three approaches maintain Unity Catalog's governance model: access control, auditing, and lineage tracking work the same whether data lives inside or outside Azure Databricks.
10
10
11
11
## Configure storage credentials and external locations
12
12
13
-
When Databricks interacts with cloud storage, it needs two things: a way to authenticate, and a definition of where the data lives. Platform administrators handle this configuration through **Catalog Explorer**, the central interface for managing all Unity Catalog objects.
13
+
When Azure Databricks interacts with cloud storage, it needs two things: a way to authenticate, and a definition of where the data lives. Platform administrators handle this configuration through **Catalog Explorer**, the central interface for managing all Unity Catalog objects.
14
14
15
15
### Storage credentials
16
16
17
-
A **storage credential** defines how Databricks authenticates to external storage—think of it as the "key" to external data. In Azure environments, the storage credential references an Azure Databricks Access Connector that a Platform Administrator creates in the Azure portal. The Access Connector is an Azure resource with a managed identity that is granted permissions on your Azure storage account. Databricks uses this managed identity to access the storage on behalf of users. Once the Access Connector exists in Azure, you register it in Unity Catalog as a storage credential.
17
+
A **storage credential** defines how Azure Databricks authenticates to external storage—think of it as the "key" to external data. In Azure environments, the storage credential references an Azure Databricks Access Connector that a Platform Administrator creates in the Azure portal. The Access Connector is an Azure resource with a managed identity that is granted permissions on your Azure storage account. Azure Databricks uses this managed identity to access the storage on behalf of users. Once the Access Connector exists in Azure, you register it in Unity Catalog as a storage credential.
18
18
19
19
To register a storage credential in Catalog Explorer:
20
20
21
-
1. Navigate to **Catalog Explorer** in your Databricks workspace
21
+
1. Navigate to **Catalog Explorer** in your Azure Databricks workspace
22
22
2. Select on **External data** in the navigation menu
23
23
3. Select **Storage credentials** and select **Create credential**
24
24
4. Provide the resource ID of your Azure Databricks Access Connector
@@ -49,9 +49,9 @@ Once configured, Unity Catalog enforces permissions on the external location and
49
49
50
50
External storage works well for data files in cloud storage. But what about data in operational databases like SQL Server, or PostgreSQL? Lakehouse Federation enables Unity Catalog to query these systems directly without copying data.
51
51
52
-
This is valuable when operational systems contain important datasets that you need to combine with Delta tables in Databricks. Rather than extracting, transforming, and loading data into Databricks, you query it where it already lives.
52
+
This is valuable when operational systems contain important datasets that you need to combine with Delta tables in Azure Databricks. Rather than extracting, transforming, and loading data into Azure Databricks, you query it where it already lives.
53
53
54
-
The federation process begins with a **connection**, which stores the authentication details and endpoint of the external system. Once the connection exists, you create a **foreign catalog** that exposes the schemas and tables from that system inside Unity Catalog. To users, these foreign catalogs behave like native Databricks catalogs—queries can join across internal and external data seamlessly.
54
+
The federation process begins with a **connection**, which stores the authentication details and endpoint of the external system. Once the connection exists, you create a **foreign catalog** that exposes the schemas and tables from that system inside Unity Catalog. To users, these foreign catalogs behave like native Azure Databricks catalogs—queries can join across internal and external data seamlessly.
55
55
56
56
### Create connections and foreign catalogs
57
57
@@ -72,7 +72,7 @@ Platform administrators set up connections and foreign catalogs through Catalog
72
72
73
73
:::image type="content" source="../media/create-foreign-catalog.png" alt-text="Screenshot of Databricks Catalog Explorer showing the Create foreign catalog dialog where Platform Admins select a connection and name the foreign catalog that will expose external database schemas and tables." lightbox="../media/create-foreign-catalog.png":::
74
74
75
-
After the foreign catalog is created, it appears in Catalog Explorer alongside your other catalogs. You can expand it to see the schemas and tables from the external database—for example, a SQL Server foreign catalog might show schemas like `dbo`, `sales`, and `inventory` with their respective tables. All of this external data is now available for queries, subject to the same governance and permissions as internal Databricks data.
75
+
After the foreign catalog is created, it appears in Catalog Explorer alongside your other catalogs. You can expand it to see the schemas and tables from the external database—for example, a SQL Server foreign catalog might show schemas like `dbo`, `sales`, and `inventory` with their respective tables. All of this external data is now available for queries, subject to the same governance and permissions as internal Azure Databricks data.
76
76
77
77
Once configured, you can query the foreign catalog using standard SQL, joining external database tables with internal Delta tables seamlessly.
0 commit comments