Transformation: retire DBFS mounts and DBFS root data — move to Unity Catalog volumes and external locations

#Why

Mounts are workspace-wide: anyone on the workspace can read through them with the mount's credential, there's no per-user audit, and they don't work on UC shared clusters. Volumes and external locations give per-group grants and audit through Unity Catalog.

#1. Inventory mounts and DBFS root usage

for m in dbutils.fs.mounts():
    print(m.mountPoint, "->", m.source)

Search code for /mnt/, dbfs:/mnt, dbfs:/FileStore, /dbfs/:

databricks workspace export-dir / ./ws-export
grep -rnE "/mnt/|dbfs:/FileStore|/dbfs/" ./ws-export | cut -d: -f1 | sort | uniq -c | sort -rn | head

UCX's assessment also lists mounts and code references.

#2. Map mounts to UC objects

CREATE EXTERNAL LOCATION lake_raw URL 'abfss://raw@stlake.dfs.core.windows.net/'
  WITH (STORAGE CREDENTIAL sc_lake);

CREATE EXTERNAL VOLUME main.ingest.raw_files
  LOCATION 'abfss://raw@stlake.dfs.core.windows.net/landing';

GRANT READ VOLUME ON VOLUME main.ingest.raw_files TO `grp-data-engineers`;
GRANT WRITE VOLUME ON VOLUME main.ingest.raw_files TO `sp-ingest`;

#3. Rewrite paths

# Before
df = spark.read.json("/mnt/raw/landing/orders/2026/10/25/")
# After
df = spark.read.json("/Volumes/main/ingest/raw_files/orders/2026/10/25/")

# Before
spark.read.format("delta").load("/mnt/lake/silver/orders")
# After
spark.table("main.silver.orders")

Python file APIs work on volumes too: open("/Volumes/ops/shared/files/config.yaml").

#4. Copy DBFS root data

The DBFS root (workspace storage account) shouldn't hold business data. Copy what's needed into volumes:

databricks fs cp -r dbfs:/FileStore/reference/ dbfs:/Volumes/ops/shared/files/reference/

#5. Remove mounts

After code has moved and jobs ran successfully:

dbutils.fs.unmount("/mnt/raw")

Remove the service principal secrets or account keys the mounts used, and rotate any storage keys that were in Spark configs.

Tip

Do the swap per mount, not per notebook: when all references to /mnt/raw are gone, unmount it. Use the grep inventory as the checklist.

#Checklist

• Mounts and DBFS paths inventoried with code references
• External locations, volumes and tables created with grants
• Code rewritten to volumes/table names; jobs tested
• DBFS root business data moved
• Mounts removed; old credentials rotated or deleted