DP-750 · 2.2.7 · Secure and govern Unity Catalog objects
Secure data sharing
Design and implement a secure strategy for Delta Sharing
Share only required governed assets with explicit recipients and revoke access centrally when it is no longer needed.
See the sharing boundary
The architecture shows why Delta Sharing is governed sharing rather than file copying: providers expose controlled access while recipients remain separate. Use the diagrams below for authentication and revocation decisions.
Understand the sharing objects
- 1Provider dataRemains under provider control
- 2ShareRead-only collection of exposed assets
- 3RecipientExternal party granted access
- 4ConsumerReads through the chosen protocol
A share groups the assets to expose. A recipient represents the party that may consume them.
Pick the sharing model
Databricks-to-Databricks
- Recipient
- Unity Catalog Databricks
- Identity
- Metastore-based
- Best fit
- Both sides on Databricks
Databricks-to-Open
- Recipient
- External compatible tool
- Identity
- Activation or credential
- Best fit
- Cross-platform sharing
The provider keeps control of the source and can remove assets or revoke recipient access centrally.
Share the minimum
Use explicit shares and recipients rather than broad exports. When a partnership ends, revoke recipient access without deleting the provider source data.
Key points
- Share: Read-only collection of assets exposed by a provider
- Recipient: External party granted access to a share
- Databricks sharing: Best fit when both sides use Unity Catalog
- Open sharing: Supports recipients outside Databricks
Exam trap
Do not duplicate data exports when governed sharing can provide controlled read access.
Sources · 1 Microsoft Learn page Show ▾
Checked on October 4, 2026. Report a problem
Go deeper on Microsoft Learn
Checked against Microsoft Learn on October 4, 2026. Report a problem with this card