Home / Data Platform / Databricks & Spark

Data PlatformTroubleshootingIntermediate

Unity Catalog PERMISSION_DENIED: granting the right privileges

Fix Unity Catalog access errors by understanding the USE CATALOG / USE SCHEMA / SELECT chain, external locations, ownership and compute access modes.

Deepak Bhardwaj2 min read

Applies toDatabricks Unity Catalog, SQL warehouses and clusters in standard/dedicated access modes

The privilege chain

To read main.sales.orders, a user (or a group they belong to) needs all three:

GRANT USE CATALOG ON CATALOG main TO `analysts`;
GRANT USE SCHEMA  ON SCHEMA  main.sales TO `analysts`;
GRANT SELECT      ON TABLE   main.sales.orders TO `analysts`;

Missing the USE CATALOG or USE SCHEMA grant is the most common cause of PERMISSION_DENIED, even when SELECT was granted.

You can grant at a higher level to cover current and future objects:

GRANT SELECT ON SCHEMA main.sales TO `analysts`;   -- all tables and views in the schema, including new ones

Check what's granted

SHOW GRANTS ON TABLE main.sales.orders;
SHOW GRANTS `jane@contoso.com` ON SCHEMA main.sales;
DESCRIBE TABLE EXTENDED main.sales.orders;          -- owner, location, type

Error messages

Error Meaning
User does not have USE CATALOG on Catalog 'main' Grant USE CATALOG
User does not have SELECT on Table ... Grant SELECT (or at schema level)
User does not have MODIFY on Table Writes need MODIFY
does not have CREATE TABLE on Schema Grant CREATE TABLE on the schema
PERMISSION_DENIED: ... READ FILES on External Location Path-based access to cloud storage. See below.
Table or view not found Wrong name, or the user can't even see it. The same error hides unauthorized objects.

External locations and files

Reading files by path (read_files('abfss://...'), COPY INTO, external tables) goes through external locations:

SHOW EXTERNAL LOCATIONS;
GRANT READ FILES  ON EXTERNAL LOCATION raw_landing TO `data_engineers`;
GRANT WRITE FILES ON EXTERNAL LOCATION raw_landing TO `data_engineers`;

The external location uses a storage credential (managed identity or IAM role). That identity needs the cloud storage permissions, such as Storage Blob Data Contributor on Azure or S3 permissions on AWS.

Compute access mode matters

  • Unity Catalog works on standard (formerly shared) and dedicated (formerly single user) access modes, and on SQL warehouses and serverless.
  • No isolation shared clusters can't use Unity Catalog. Users see only hive_metastore.
  • On a dedicated cluster assigned to one user, that user's permissions apply, even if someone else runs the notebook.

Ownership and groups

  • An object's owner has all privileges on it. Transfer ownership to a group, not to an individual who might leave:
    ALTER TABLE main.sales.orders OWNER TO `data_platform_admins`;
  • Grant to account-level groups (synced from Entra ID or your IdP), not workspace-local groups.

Tip

Turn on system tables (system.access.audit) and query recent PERMISSION_DENIED events. They show the exact privilege and object each user was missing.

Related fixes