Why it has to go
Credential passthrough is a legacy feature (no new support, limited runtimes) and table ACLs only cover the workspace Hive metastore. Unity Catalog gives one permission model across workspaces, audit logs, lineage and fine-grained controls.
1. Capture the current access model
- Passthrough: permissions live in ADLS ACLs / RBAC on storage. Export them:
az storage fs access show --account-name stlake --file-system raw --path sales --auth-mode login
- Table ACLs: export grants from the workspace metastore:
SHOW GRANTS ON SCHEMA hive_metastore.sales;
SHOW GRANTS ON TABLE hive_metastore.sales.orders;
Write a table: who (group) → what (path/table) → which right (read/write).
2. Map to Unity Catalog
| Old | Unity Catalog |
|---|---|
| ADLS ACL read on a folder | SELECT on tables in that folder; READ FILES on the external location/volume |
| ADLS ACL write | MODIFY on tables; WRITE FILES on volume/location |
Table ACL SELECT / MODIFY | Same privileges on the UC table |
USAGE on database | USE CATALOG + USE SCHEMA |
| Separate views per audience | Row filters / column masks, or views |
Grant to Entra-synced groups, not users:
GRANT USE CATALOG ON CATALOG main TO `grp-sales-readers`;
GRANT USE SCHEMA, SELECT ON SCHEMA main.sales TO `grp-sales-readers`;
GRANT MODIFY ON TABLE main.sales.orders TO `grp-sales-engineers`;
3. Storage access moves to the access connector
Users no longer need storage RBAC/ACLs: UC reads storage through the access connector's managed identity. Plan to remove user storage permissions afterwards, otherwise people can bypass UC with direct abfss:// reads.
4. Tables
Upgrade tables into UC (see the Hive metastore to Unity Catalog / UCX post). UCX can also translate legacy table ACLs and assess passthrough clusters.
5. Clusters and testing
Switch clusters to standard (shared) or dedicated access mode. Test with a person from each group: the queries they ran yesterday should work, and things they shouldn't see should fail.
6. Clean up
Disable passthrough on remaining clusters, remove storage ACLs/RBAC for user groups, and keep only the access connector identities on the storage accounts.
Caution
Passthrough enforced per-user ADLS ACLs. If you grant UC privileges more broadly than those ACLs, people may suddenly see more data. Compare old and new access before switching.
Checklist
- Current ACLs and grants exported
- Mapping table reviewed by data owners
- Grants applied to groups; filters/masks where needed
- Users tested per group
- Passthrough disabled; user storage permissions removed