Introduction

Granting privileges in Databricks Unity Catalog allows admins to control access to catalogs, schemas, and tables. However, if an admin cannot grant privileges to users, it could be due to missing metastore permissions, workspace configuration issues, or incorrect role assignments.

🚨 Common errors when granting privileges in Unity Catalog:

• Error: “PERMISSION_DENIED: User does not have permission to grant privileges.”
• Error: “Operation not allowed: Missing required privilege.”
• Error: “GRANT command failed: Object does not exist.”
• Users cannot see the granted privileges after execution.

This guide walks through troubleshooting steps and solutions to ensure admins can properly assign privileges in Unity Catalog.

---

1. Verify That the Admin Has Metastore Administrator Privileges

Symptoms:

• Error: “PERMISSION_DENIED: User does not have permission to grant privileges.”
• Admin can see Unity Catalog but cannot manage access.
• Cannot execute GRANT or REVOKE commands.

Causes:

• The admin account does not have the “Metastore Admin” role.
• The workspace metastore is not properly configured for privilege management.
• The Databricks account is not recognized as an admin in Unity Catalog.

Fix:

✅ Check if the user is a Metastore Admin:

SHOW GRANTS ON METASTORE;

✅ If missing, assign Metastore Admin role:

databricks unity-catalog metastores update --metastore-id <metastore-id> --owner <admin-email>

✅ If using Azure, assign Admin Role via Azure CLI:

az role assignment create --assignee <admin-email> --role "Storage Blob Data Contributor"

✅ If the Metastore Admin role is missing, recreate the metastore and reassign it.

---

2. Ensure the Admin Has the GRANT OPTION Privilege

Symptoms:

• Error: “Operation not allowed: User does not have the required privilege to grant access.”
• The admin can see objects but cannot grant permissions.

Causes:

• The admin does not have the GRANT OPTION privilege on the catalog or schema.
• The privilege hierarchy is not correctly set up in Unity Catalog.

Fix:

✅ Grant the admin full privileges with GRANT OPTION:

GRANT ALL PRIVILEGES ON CATALOG main TO `admin@example.com` WITH GRANT OPTION;

✅ Verify that the GRANT OPTION is assigned:

SHOW GRANTS ON CATALOG main;

✅ If needed, reassign privileges:

GRANT USE SCHEMA ON SCHEMA main.sales TO `admin@example.com` WITH GRANT OPTION;

---

3. Check If the Catalog, Schema, or Table Exists

Symptoms:

• Error: “GRANT command failed: Object does not exist.”
• The admin tries to grant privileges on a missing or unregistered catalog/schema.

Causes:

• The catalog or schema is not registered in Unity Catalog.
• The admin is trying to grant access to a non-existent object.

Fix:

✅ Check available catalogs and schemas:

SHOW CATALOGS;
SHOW SCHEMAS IN main;

✅ Ensure the object exists before granting privileges:

DESCRIBE CATALOG main;

✅ If missing, create the catalog/schema and retry:

CREATE CATALOG IF NOT EXISTS main;
CREATE SCHEMA IF NOT EXISTS main.sales;

---

4. Verify That the Cluster or SQL Warehouse Supports Unity Catalog

Symptoms:

• The admin can grant privileges, but users cannot access granted objects.
• Users report missing objects despite having access rights.

Causes:

• The cluster is not Unity Catalog-enabled.
• The workspace does not support Unity Catalog for SQL Warehouses.

Fix:

✅ Ensure the cluster is Unity Catalog-enabled:

1. Go to Databricks UI → Clusters
2. Edit the cluster → Enable Unity Catalog under Advanced Options
3. Restart the cluster after making changes.

✅ Ensure SQL Warehouses support Unity Catalog:

1. Go to Databricks UI → SQL Warehouses
2. Edit the warehouse settings to support Unity Catalog.

✅ Verify Unity Catalog metadata is available in the session:

SELECT current_catalog(), current_schema();

---

5. Ensure Users Have the Necessary Privileges to Access Objects

Symptoms:

• Users do not see objects even after privileges are granted.
• Error: “Permission denied: User does not have access to this catalog.”

Causes:

• The user does not have USE CATALOG or USE SCHEMA privileges.
• The privileges were not applied to the correct principal (user/group).

Fix:

✅ Grant explicit access to catalogs and schemas:

GRANT USE CATALOG ON CATALOG main TO `user@example.com`;
GRANT USE SCHEMA ON SCHEMA main.sales TO `user@example.com`;
GRANT SELECT ON TABLE main.sales.orders TO `user@example.com`;

✅ If using groups, assign privileges at the group level:

GRANT SELECT ON TABLE main.sales.orders TO `finance_team`;

✅ Verify that the user can see the granted privileges:

SHOW GRANTS ON SCHEMA main.sales;

---

6. Resolve Azure AD or AWS IAM Permission Conflicts

Symptoms:

• Users with correct Databricks privileges still cannot access Unity Catalog.
• Azure AD users are unable to see assigned privileges.
• AWS IAM roles are blocking access to certain Unity Catalog objects.

Causes:

• Azure AD roles do not have access to storage behind Unity Catalog.
• AWS IAM roles lack permission to read/write data.

Fix:

✅ For Azure, assign proper storage permissions:

az role assignment create --assignee <user> --role "Storage Blob Data Contributor" --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storage-name>

✅ For AWS, ensure IAM roles have necessary access:

{
  "Effect": "Allow",
  "Action": ["glue:Get*", "s3:GetObject", "s3:PutObject"],
  "Resource": "*"
}

✅ Ensure Unity Catalog can access storage:

DESCRIBE EXTERNAL LOCATION my_location;

---

7. Step-by-Step Troubleshooting Guide

Step 1: Verify Metastore Admin Privileges

SHOW GRANTS ON METASTORE;

• If missing, assign Metastore Admin role.

Step 2: Check If GRANT OPTION Is Assigned

SHOW GRANTS ON CATALOG main;

• If missing, reassign privileges with GRANT OPTION.

Step 3: Ensure the Catalog and Schema Exist

SHOW CATALOGS;
SHOW SCHEMAS IN main;

• If missing, create missing objects.

Step 4: Confirm Cluster and SQL Warehouse Support Unity Catalog

SELECT current_catalog();

• If incorrect, restart cluster with Unity Catalog enabled.

Step 5: Validate User and Group Privileges

SHOW GRANTS ON SCHEMA main.sales;

• If missing, grant explicit access to users.

---

Best Practices for Granting Privileges in Unity Catalog

✅ Always Grant Permissions Using Groups Instead of Individual Users

GRANT SELECT ON TABLE main.sales.orders TO `data_team`;

✅ Assign Privileges at the Highest Necessary Level

GRANT USE CATALOG ON CATALOG main TO `analyst_group`;

✅ Regularly Audit Access Controls

SHOW GRANTS ON CATALOG main;

✅ Ensure All Workloads Are Using Unity Catalog-Enabled Clusters

• Migrate legacy clusters to Unity Catalog-supported configurations.

---

Conclusion

If admins cannot grant privileges in Unity Catalog, check:
✅ The admin has Metastore Admin role.
✅ The GRANT OPTION privilege is assigned.
✅ The catalog/schema exists and is accessible.
✅ Clusters and SQL Warehouses support Unity Catalog.
✅ IAM and Azure AD roles allow necessary permissions.

By following these steps, you can successfully manage access control in Unity Catalog and ensure users have the correct privileges.