Sev1: Unity Catalog table or schema dropped by mistake — UNDROP and RESTORE

#1. What kind of table was it?

#2. Managed table: UNDROP

SHOW TABLES DROPPED IN main.sales;

The output lists dropped tables with their table ID and drop time.

UNDROP TABLE main.sales.orders;
-- if several dropped tables share the name, pick one by ID:
UNDROP TABLE WITH ID '6c5a8f2e-1a2b-4c3d-9e8f-0123456789ab';

If a new table with the same name was created since (a pipeline re-ran CREATE OR REPLACE), rename that one first:

ALTER TABLE main.sales.orders RENAME TO main.sales.orders_recreated;
UNDROP TABLE main.sales.orders;

Grants on the table come back with it; check row filters, column masks and tags.

Warning

The retention window is short (7 days at the time of writing — check current docs). After it, managed table data is permanently purged.

#3. External table: re-register

CREATE TABLE main.sales.orders_ext
USING DELTA
LOCATION 'abfss://sales@stlake.dfs.core.windows.net/tables/orders';

The Delta log in the folder holds schema, history and properties. Re-apply grants and comments.

#4. Dropped schema

-- Schemas with managed tables: tables are recoverable individually after re-creating the schema
CREATE SCHEMA main.sales;
SHOW TABLES DROPPED IN main.sales;
UNDROP TABLE main.sales.orders;

Check DROP SCHEMA ... CASCADE behaviour and limits for your runtime; recover the most important tables first.

#5. Table exists but data was overwritten

DESCRIBE HISTORY main.sales.orders LIMIT 20;
RESTORE TABLE main.sales.orders TO TIMESTAMP AS OF '2026-10-25T05:00:00Z';

RESTORE works within the time travel retention (delta.deletedFileRetentionDuration, and only if VACUUM hasn't removed the files).

#6. Find who and why

SELECT event_time, user_identity.email, action_name, request_params
FROM system.access.audit
WHERE service_name = 'unityCatalog' AND action_name IN ('deleteTable', 'deleteSchema')
  AND event_date >= current_date() - 2
ORDER BY event_time DESC;

Often it's a dev script run with production credentials, or a CREATE OR REPLACE in a notebook.

#Prevent it next time

• Production tables owned by groups; developers get SELECT/MODIFY but not ownership (DROP needs ownership or MANAGE).
• Separate catalogs per environment and bind production catalogs only to production workspaces (workspace-catalog binding).
• Deep clone or backup critical tables daily if a 7-day window isn't enough.