Unity Catalog basics: metastore, catalogs, schemas, tables, volumes and who can see what

Unity Catalog (UC) is where Databricks keeps track of your data and who may use it. If you know four object types and three privileges, you can do most daily work.

#The hierarchy

Metastore (one per Azure region, attached to workspaces)
└── Catalog            e.g. sales_prod, sales_dev, sandbox
    └── Schema         e.g. sales_prod.orders
        ├── Table      e.g. sales_prod.orders.order_lines
        ├── View
        ├── Volume     e.g. sales_prod.orders.landing   (files)
        └── Function / Model

You refer to objects with three parts: catalog.schema.object.

SELECT * FROM sales_prod.orders.order_lines LIMIT 10;

#Explore

SHOW CATALOGS;
SHOW SCHEMAS IN sales_prod;
SHOW TABLES IN sales_prod.orders;
DESCRIBE TABLE EXTENDED sales_prod.orders.order_lines;

The Catalog explorer in the sidebar shows the same thing, plus sample data, lineage and permissions.

#Managed vs external tables

-- managed (recommended default)
CREATE TABLE sales_dev.orders.customers (id BIGINT, name STRING, country STRING);

-- external, needs an external location you have access to
CREATE TABLE sales_dev.orders.customers_ext (id BIGINT, name STRING)
LOCATION 'abfss://lake@stsalesdata.dfs.core.windows.net/external/customers';

#Volumes: governed files

Volumes hold non-tabular files (CSV drops, images, PDFs, model files) with the same permissions model as tables.

CREATE VOLUME sales_dev.orders.landing;

dbutils.fs.ls("/Volumes/sales_dev/orders/landing/")
df = spark.read.option("header", True).csv("/Volumes/sales_dev/orders/landing/2026-10-29/")

Use volumes instead of DBFS mounts for new work.

#Permissions in three statements

Access needs the right privilege at every level:

• USE CATALOG on the catalog
• USE SCHEMA on the schema
• SELECT (or MODIFY, etc.) on the table

GRANT USE CATALOG ON CATALOG sales_prod TO `analysts`;
GRANT USE SCHEMA  ON SCHEMA  sales_prod.orders TO `analysts`;
GRANT SELECT      ON SCHEMA  sales_prod.orders TO `analysts`;    -- all current and future tables in the schema

Grant to groups, not individuals. Groups normally come from Entra ID through SCIM provisioning.

Check what someone has:

SHOW GRANTS ON TABLE sales_prod.orders.order_lines;
SHOW GRANTS `analysts` ON SCHEMA sales_prod.orders;

Tip

"Table or view not found" often means "you lack USE CATALOG or USE SCHEMA", not that the table is missing. Unity Catalog hides objects you cannot use.

#Common privileges

The owner of an object can do anything with it and grant privileges. Make a group the owner of production objects, not a person who might leave.

ALTER TABLE sales_prod.orders.order_lines OWNER TO `data-platform-admins`;

#A typical catalog layout

Catalogs can be bound to specific workspaces, so the prod catalog is only reachable from the prod workspace.

#Find and trust data

• Comments: COMMENT ON TABLE sales_prod.orders.order_lines IS 'One row per order line, loaded hourly';
• Tags: ALTER TABLE ... SET TAGS ('pii' = 'true');
• Lineage: the Lineage tab shows which jobs and notebooks read and write each table.

#Prevent it next time

• Grant at schema level to groups; avoid one-off table grants to people.
• Use managed tables and volumes by default.
• Transfer ownership of shared objects to groups.