DP-750 · 2.1.5 · Secure and govern Unity Catalog objects
Managed identity access
Authenticate resource access by using managed identities
Use Azure managed identities for credential-free access from Unity Catalog to supported Azure resources such as storage.
See where the managed identity is configured
Managed identity removes stored client secrets from the access path. The portal screen shows the identity attached to the Access Connector; the diagrams below show how that identity reaches governed storage.
Remove stored client secrets
- 1Access ConnectorProvides Azure managed identity
- 2Azure RBACGrants storage permissions
- 3Storage credentialReferences the identity
- 4External locationGoverns the storage path
Managed identity removes the need for an application-managed client secret, but Azure RBAC still determines what the identity can access.
Connect identity to Unity Catalog
- 1Managed identityAzure-managed workload identity
- 2Access ConnectorMakes it available to Databricks
- 3Storage credentialStores the cloud identity reference
- 4External locationBinds identity to a storage path
The Access Connector bridges the Azure identity into Databricks. Unity Catalog then references it through a storage credential.
Know the benefit
Compared with a service principal secret, managed identity removes secret storage and rotation. It does not remove least privilege, RBAC, or auditing.
Key points
- Managed identity: Azure-managed application identity
- Access Connector: Bridges identity into Azure Databricks
- Storage credential: References the managed identity
- Benefit: No client secret rotation
Exam trap
Managed identity removes stored credentials, not the need for Azure RBAC permissions.
Sources · 1 Microsoft Learn page Show ▾
Checked on October 4, 2026. Report a problem
Go deeper on Microsoft Learn
Checked against Microsoft Learn on October 4, 2026. Report a problem with this card