ENNL
Book a call
Courses

Intermediate / Self-paced, Online

Governance with Unity Catalog

Identity, privileges, policies, evidence, sharing and governance as code

Start courseSee the syllabus
Level
Intermediate
Total time
about 5 h
Lessons
7
Labs
7
Last verified
2026-11-11

What you will learn

  • Model assets as securable objects in a catalog.schema.object namespace with group owners
  • Set up identity with Entra ID groups, service principals and eligible admin roles
  • Apply the reader and contributor group per schema pattern with the right privileges
  • Use row filters, column masks and ABAC policies and know their limits
  • Prove governance with lineage, audit logs and scheduled checks
  • Share data with OpenSharing and define the whole model in Terraform

Who it is for

Teams that must give many people and workloads the right access to data and AI assets, and prove it to security, audit and clients.

Platform and data engineers who design or run access control on Azure Databricks

What you need first

Basic SQL and some familiarity with Azure Databricks. Course 2 helps but is not required. Lessons 1 to 4 can be followed in Free Edition for SQL exercises where your workspace allows it.

Syllabus

Lessons build on each other, so follow them in order the first time. Under each title you see what you can do by the end of the lesson.

  1. The Unity Catalog object model

    Lesson 1 · 40 min · Lab included

    • Name the securable objects and the catalog.schema.object namespace
    • Choose managed or external for tables and volumes
    • Design a namespace with environment catalogs and layer schemas
    • Make a group the owner of every securable

  2. Identity: Entra ID, groups and service principals

    Lesson 2 · 45 min · Lab included

    • Name the three identity types and how identity federation works
    • Use Entra ID as the source of record with automatic identity management
    • Apply a group naming convention per scope
    • Make privileged roles eligible through PIM and run automation as service principals

  3. Privileges and the reader and contributor pattern

    Lesson 3 · 50 min · Lab included

    • Name the privileges you use daily and their prerequisites
    • Explain inheritance and why the schema is the right level
    • Apply the reader and contributor group per schema pattern
    • Handle sensitive tables with separate schemas or table-level groups

  4. Row filters, column masks and ABAC

    Lesson 4 · 50 min · Lab included

    • Explain how a row filter and a column mask are bound to a table
    • Choose between table-level controls and ABAC policies
    • Check the documented limits before committing to a design
    • Test a policy with identities from each group

  5. Lineage, audit logs and system tables

    Lesson 5 · 45 min · Lab included

    • Use lineage for impact analysis, root cause and privacy questions
    • Name the key columns of the audit table and its regional scope
    • State the documented lineage limitations before making claims
    • Turn governance rules into scheduled checks with owners

  6. Sharing data safely with OpenSharing

    Lesson 6 · 40 min · Lab included

    • Describe shares, providers and recipients as securable objects
    • Choose between the open route and the Databricks-to-Databricks route
    • Design a minimised gold table for a share
    • Govern shares with ownership, review, audit and an end date

  7. Governance as code with Terraform

    Lesson 7 · 55 min · Lab included

    • Decide which objects belong in Terraform and which in bundles
    • Choose between authoritative and additive grant resources
    • Write a module for the reader and contributor pattern
    • Describe the pipeline with plan review, approvals and drift detection

Final project

Capstone: governance design for a two-domain platform

Design the governance of a platform with two domains, finance and operations, in four environments. Deliver the namespace, the Entra ID group list, the privilege matrix for every schema, one row filter or ABAC policy for a sensitive table, a sharing design for one external partner, a list of scheduled governance checks and a Terraform module that creates a schema with its reader and contributor grants. Validate the Terraform with terraform validate.

The final project applies the whole course. Mark it done when you can tick every item.

What good looks like

  • Catalogs are per environment and domain, schemas per layer, and every catalog and schema has a group as owner
  • No grant has a person as principal, and group names follow one documented convention
  • Every schema has a reader and a contributor group and the matrix lists USE CATALOG and USE SCHEMA
  • The sensitive table policy has tests for a member and a non-member and states the documented limits that apply
  • The sharing design shares a minimised gold table, names the owner, the agreement and an end date, and does not rely on a filter
  • At least five scheduled governance checks are defined with owners and alert targets
  • The Terraform module uses authoritative grants on the schema and additive grants on the shared catalog, and terraform validate passes

Keep going

Learning paths with this course

How we do this for clients

Learn this with your team

We run this course as a live workshop for teams, on-site or online, and adapt the labs to your platform.

See the workshops

Next step

Want your team to learn this together?

We give workshops to company teams and students, on-site or online. Tell us who the participants are and what they should be able to do afterwards.

Book a callSend a messageor email info@nexops.nl directly

Accepting projects for Q4 2026