What Is Unity Catalog? Complete Guide to Databricks Data Governance

Unity Catalog is the account-level unified data governance layer provided by Databricks. It delivers centralized access control, audit logging, and data lineage across multiple workspaces for every data asset, including tables, views, functions, ML models, and files (Volumes). It unifies metadata management that used to be fragmented per workspace in the legacy Hive Metastore by introducing a three-level namespace of catalog.schema.table, and enables SQL-standard GRANT/REVOKE-based permission management.

This article covers Unity Catalog end-to-end: hierarchy, permission model, External Locations, Delta Sharing integration, and how it differs from Hive Metastore. It also highlights the points tested on the Data Engineer Associate (DEA) exam, focusing on the Data Governance domain (17% of the exam).

Unity Catalog Hierarchy

Unity Catalog uses a four-level object model topped by the metastore. Every data asset sits in this tree, and permissions are inherited from parents down to children.

Metastore (one per account, per region)
 ├── Catalog: production
 │    ├── Schema: sales
 │    │    ├── Table: orders
 │    │    ├── Table: customers
 │    │    ├── View: daily_summary
 │    │    └── Function: calc_tax()
 │    ├── Schema: marketing
 │    │    ├── Table: campaigns
 │    │    └── Volume: raw_files
 │    └── Schema: information_schema (auto-generated)
 ├── Catalog: development
 │    └── Schema: sandbox
 │         └── Table: test_orders
 ├── External Location: s3://data-lake/external/
 └── Storage Credential: aws_s3_role

When you reference a data asset, always use the three-level namespace catalog.schema.object. This makes it possible to uniquely identify which environment, which domain, and which table is being referenced just from the name.

-- Access via the three-level namespace
SELECT * FROM production.sales.orders;
--            ^^^^^^^^^^  ^^^^^  ^^^^^^
--            Catalog     Schema Table

-- Set a default Catalog/Schema
USE CATALOG production;
USE SCHEMA sales;

-- After the settings above, you can use short names
SELECT * FROM orders;

Role of Each Level and Design Patterns

Creating Catalogs and Schemas

To store data assets in Unity Catalog, you first create a Catalog and a Schema. Catalogs can be created by the Metastore Admin (or any user holding the CREATE CATALOG privilege), and Schemas can be created by the Catalog owner (or any user holding the CREATE SCHEMA privilege).

-- Create a Catalog
CREATE CATALOG IF NOT EXISTS production
COMMENT 'Production environment catalog';

-- Create a Schema
CREATE SCHEMA IF NOT EXISTS production.sales
COMMENT 'Sales domain tables';

-- Create a Managed Table (no LOCATION -> stored in Unity Catalog-managed storage)
CREATE TABLE production.sales.orders (
  order_id     BIGINT       GENERATED ALWAYS AS IDENTITY,
  customer_id  BIGINT       NOT NULL,
  amount       DECIMAL(12,2) NOT NULL,
  order_date   DATE         NOT NULL,
  status       STRING       DEFAULT 'pending'
)
COMMENT 'Customer order records'
TBLPROPERTIES ('quality' = 'gold');

-- Create an External Table (with LOCATION -> references data in external storage)
CREATE TABLE production.sales.external_logs (
  log_id    BIGINT,
  message   STRING,
  timestamp TIMESTAMP
)
LOCATION 's3://data-lake/external/sales/logs/';

Permission Management (GRANT / REVOKE)

Unity Catalog enforces access control with SQL-standard GRANT/REVOKE syntax. Privileges are granted on Securable Objects (Catalog, Schema, Table, View, Function, Volume, External Location, Storage Credential) and attached to users or groups (principals).

Main Privilege Types

SQL Examples for Granting Privileges

-- Step 1: Open access to the Catalog (open the hallway)
GRANT USAGE ON CATALOG production TO analysts;

-- Step 2: Open USAGE on the Schema
GRANT USAGE ON SCHEMA production.sales TO analysts;

-- Step 3: Grant SELECT on tables (let them into the room)
GRANT SELECT ON SCHEMA production.sales TO analysts;
-- ^ SELECT applies to every table under the Schema

-- Restrict to a specific table
GRANT SELECT ON TABLE production.sales.orders TO analysts;

-- Grant data modification privilege
GRANT MODIFY ON TABLE production.sales.orders TO etl_service;

-- Privilege to create tables in a Schema
GRANT CREATE TABLE ON SCHEMA production.sales TO data_engineers;

-- Inspect privileges
SHOW GRANTS ON SCHEMA production.sales;
SHOW GRANTS TO analysts;

-- Revoke a privilege
REVOKE SELECT ON SCHEMA production.sales FROM analysts;

Privilege Inheritance Model

Unity Catalog privileges flow from parent objects down to children. For example, granting SELECT on a Catalog applies SELECT to every Schema and table under that Catalog. However, USAGE is not inherited automatically. Unless you explicitly grant USAGE on both the parent Catalog and the Schema, having SELECT on the underlying table is not enough to access the data.

Privilege inheritance:

GRANT SELECT ON CATALOG production TO analysts;
 -> SELECT inherited by every Schema and Table under production

But USAGE is still required:
 Catalog: production  -> USAGE required ✓
   Schema: sales      -> USAGE required ✓
     Table: orders    -> readable with SELECT ✓

When USAGE is missing:
 Catalog: production  -> no USAGE ✗
   Schema: sales      -> USAGE granted
     Table: orders    -> SELECT granted -> but inaccessible ✗

Managed Tables vs. External Tables

Tables registered in Unity Catalog are categorized as Managed Tables or External Tables based on where the data is stored. The DROP behavior is fundamentally different, so the choice matters at design time.

Exam favorite: "What happens to the data files after DROP TABLE?" -> Managed Table deletes the data too; External Table only deletes the metadata.

External Locations and Storage Credentials

To create an External Table, you must register the credentials Unity Catalog uses to access external storage. The mechanism has two layers: Storage Credential and External Location.

[Storage Credential]          Register cloud credentials
        |                     (IAM role / Service Principal / Service Account)
        v
[External Location]           Bind a credential to an allowed path
  url: s3://bucket/path/      "With these credentials, access to this path is OK"
        |
        v
[External Table]              Create a table with LOCATION pointing at the external path
  production.sales.ext_logs
  LOCATION 's3://bucket/path/logs/'

Setup Flow (SQL)

-- 1. Create a Storage Credential (requires Metastore Admin)
CREATE STORAGE CREDENTIAL aws_s3_credential
WITH (
  AWS_IAM_ROLE = 'arn:aws:iam::123456789012:role/unity-catalog-role'
);

-- 2. Create an External Location
CREATE EXTERNAL LOCATION s3_data_lake
URL 's3://my-data-lake/production/'
WITH (STORAGE CREDENTIAL aws_s3_credential)
COMMENT 'Production data lake on S3';

-- 3. Grant privileges on the External Location
GRANT CREATE EXTERNAL TABLE ON EXTERNAL LOCATION s3_data_lake
TO data_engineers;

-- 4. Create the External Table
CREATE TABLE production.sales.external_events (
  event_id   BIGINT,
  event_type STRING,
  payload    STRING,
  created_at TIMESTAMP
)
LOCATION 's3://my-data-lake/production/events/';

A Storage Credential can be reused across multiple External Locations. For example, a single IAM role can back two External Locations — s3://bucket/sales/ and s3://bucket/marketing/ — so different teams get distinct, well-bounded access ranges.

Comparison with Hive Metastore

Unity Catalog was designed to solve the governance pain points of the legacy Hive Metastore. If you are planning a migration, you need to understand the following differences.

Unity Catalog and Delta Sharing

Delta Sharing is an open protocol for securely sharing data across organizational boundaries. Unity Catalog acts as a Delta Sharing provider and can share data with other organizations' Databricks environments as well as non-Databricks environments (Spark, Pandas, Power BI, Tableau, and more).

-- Create a Share
CREATE SHARE customer_analytics;

-- Add a table to the Share
ALTER SHARE customer_analytics
ADD TABLE production.sales.orders;

-- Create a Recipient
CREATE RECIPIENT partner_company
USING ID 'partner-sharing-identifier';

-- Grant the Recipient access to the Share
GRANT SELECT ON SHARE customer_analytics TO RECIPIENT partner_company;

• No data copy is created (the recipient reads directly from the provider's storage)
• Sharing scope can be controlled at the table or partition level
• Recipients do not need to be Databricks users (open protocol)
• Access logs for shared data are recorded in the provider's audit logs

Volumes (File Governance)

Volumes let you govern non-table files (CSV, JSON, images, model artifacts, configuration files, and so on) under the Unity Catalog permission model. The legacy DBFS (Databricks File System) had no governance and could not track who accessed which file. Because Volumes are created under a Catalog/Schema, you can control privileges with GRANT/REVOKE and access is recorded in the audit logs.

-- Create a Managed Volume (stored in Unity Catalog-managed storage)
CREATE VOLUME production.raw.landing_files;

-- Create an External Volume (references an external path)
CREATE EXTERNAL VOLUME production.raw.s3_landing
LOCATION 's3://my-bucket/landing/';

-- List files
LIST '/Volumes/production/raw/landing_files/';

-- Read files from SQL
SELECT * FROM csv.`/Volumes/production/raw/landing_files/2026-03/data.csv`;

-- Read files in a Volume from Python
-- df = spark.read.csv("/Volumes/production/raw/landing_files/2026-03/data.csv")

Data Lineage and Auditing

Unity Catalog automatically parses the Spark queries run in notebooks and jobs, and records the data flow (lineage) between tables and between columns. No manual setup or activation is required — it works automatically wherever Unity Catalog is enabled.

• Table-level lineage: Tracks that data from table A flowed into table B
• Column-level lineage: Tracks which source columns a given column was derived from
• Impact analysis: Check up-front which downstream tables will be affected if you change a table's schema
• Compliance: Track how PII data propagated across tables to support regulations such as GDPR

Audit logs are written to the system.access.audit table (System Tables). You can query who did what to which object and when directly in SQL.

-- Audit events in the last 24 hours
SELECT
  event_time,
  user_identity.email AS user_email,
  action_name,
  request_params.full_name_arg AS object_name
FROM system.access.audit
WHERE event_time > current_timestamp() - INTERVAL 24 HOURS
  AND action_name IN ('getTable', 'createTable', 'grantPermission')
ORDER BY event_time DESC;

Key Points Tested on the Exam (DEA 17%)

On the Data Engineer Associate (DEA) exam, the Data Governance domain accounts for about 17% of the questions. Unity Catalog is the core topic in that domain. Make sure you nail the items below.

Sample Questions

Frequently Asked Questions