Skip to content
datastudyguides

DP-750 · 2.1.1 · Secure and govern Unity Catalog objects

Grant UC privileges

Grant privileges to a principal (user, service principal, or group) for securable objects in Unity Catalog

Grant privileges to users, groups, or service principals on the smallest securable scope that meets the need.

See the access path

Microsoft Learn Unity Catalog object model showing the metastore, catalogs, schemas, tables, views, volumes, functions, models, and services.

A principal reaches data through the Unity Catalog hierarchy. A table reader normally needs the required parent usage privileges plus the data privilege on the object.

Grant only the needed action

  1. 1PrincipalUser, group, or service principal
  2. 2CatalogUSE CATALOG
  3. 3SchemaUSE SCHEMA
  4. 4TableSELECT
Typical table read

GRANT adds a privilege and REVOKE removes it. Data privileges are separate from compute ACLs.

Prefer groups for people

  • One automation identityService principal
  • A team of peopleGroup
  • One exceptional userUser
Pick the principal

Group grants scale better because membership can change without redesigning object permissions.

Key points

  • Principal: User, group, or service principal
  • GRANT: Adds a privilege on a securable
  • REVOKE: Removes a previously available privilege
  • Hierarchy: Parent usage privileges can still be required

Exam trap

SELECT on a table is not enough when required USE CATALOG or USE SCHEMA is missing.

Sources · 1 Microsoft Learn page Show ▾

Checked on October 4, 2026. Report a problem

Go deeper on Microsoft Learn

Checked against Microsoft Learn on October 4, 2026. Report a problem with this card

How well do you know this?