Question
You have an Azure Databricks workspace that is enabled for Unity Catalog and contains two catalogs named Catalog1 and Catalog2.
An external application uses a service principal named SP1 to connect to a SQL warehouse.
You need to ensure that SP1 can query the data in Catalog1 and Catalog2. The solution must follow the principle of least privilege.
Which permissions should you grant to SP1 for the catalogs?
- A. USE SCHEMA and SELECT
- B. USE CATALOG and SELECT
- C. USE CATALOG, USE SCHEMA, and SELECT Correct
- D. USE CATALOG and USE SCHEMA
Explanation
Reading a table in Unity Catalog needs all three privileges: USE CATALOG on the catalog, USE SCHEMA on the schema, and SELECT on the table. USE CATALOG and USE SCHEMA are required to interact with objects in those containers but do not themselves grant access to data, so option D cannot return any rows. Options A and B each leave out a required usage privilege. Granted at catalog level, USE SCHEMA and SELECT are inherited by the schemas and tables in the catalog.
