Who can access our data and systems?

Summary

• On the Databricks Platform, you decide who can access your data and systems: Unity Catalog is the central authorization engine, and access is denied unless a grant, policy, and identity check all pass.
• Access is controlled in layers — role-based access control (RBAC), attribute-based access control (ABAC), and row filters and column masks — enforced at query time so the same rules apply across SQL, notebooks, jobs, BI tools, and Genie.
• Only trusted identities and networks connect: account-level SSO with multi-factor authentication, SCIM auto-provisioning and de-provisioning, short-lived OAuth tokens, IP access lists, and private connectivity.
• Every access is recorded — Unity Catalog captures centralized audit logs of who queried what and which policies applied, and most customer data stays in your own cloud account.
• The platform is independently audited against standards including SOC 2 Type II, ISO 27001, HIPAA, and PCI-DSS; see the Security and Trust Center.

Who can access our data and systems?

On the Databricks Platform, you control who can access your data and systems. Only the identities and services you authorize can reach data, every request is authenticated and evaluated against your policies, sensitive values can be hidden even from users who can query a table, and every action is logged. Unity Catalog governs who can access what across the entire data and AI lifecycle, and access is denied unless the required grant, policy, and identity checks all pass — one consistent governance model for analytics, AI, and applications.

Why the Databricks Platform lets you control who can access your data

• Centralized access control and RBAC. Unity Catalog is the single authorization engine. It uses hierarchical role-based access control: privileges granted on a catalog flow down to its schemas, tables, and volumes, and administrators use GRANT and REVOKE to enforce least-privilege access. Because permissions are enforced at the SQL engine level, the same rules apply no matter how data is queried.
• Attribute-based access control (ABAC). ABAC governs access using governed tags rather than object-by-object grants — for example, restricting any table tagged as containing personal data to authorized groups. Policies attach at the catalog, schema, or table level and inherit automatically. See how to scale data governance with ABAC.
• Row-level security and column masking. row filters and column masks control what a user sees inside a table: row filters limit which rows a user can query, and column masks transform sensitive values before they are returned. Both are evaluated at query time, so they cannot be bypassed with a SELECT *.
• Strong identity: SSO, MFA, and SCIM. Access is authenticated through account-level single sign-on with multi-factor authentication from your identity provider. SCIM and automatic identity management provision and automatically de-provision users, so access is revoked when someone leaves. OAuth token authentication uses short-lived tokens for user-to-machine and machine-to-machine access to limit credential exposure.
• Network isolation and private connectivity. Network controls keep access limited to trusted networks: front-end PrivateLink restricts workspace access to private networks, IP access lists allow connections only from approved locations, and egress controls plus private connectivity keep data from leaving through untrusted paths.
• Scoped administrative roles. Account admin, workspace admin, and metastore admin each have defined scopes, and the creation of data-access securables such as storage credentials and external locations can be restricted to administrators, so users are granted permission to use approved resources rather than create new ones.
• Encryption at rest and in transit. Databricks encrypts data in transit and at rest, with operational data encrypted using AES-256, and Enterprise-tier customers can add customer-managed keys to keep control of the keys that protect their data.
• Comprehensive audit logging. Every access is recorded. Unity Catalog captures centralized audit logs of who queried what and which policies applied, and credential and storage access appears in your cloud provider's audit logs, giving you a complete record for monitoring and compliance.
• Tenant isolation. Most customer data stays in your own cloud account. Requests pass through an authenticating layer that verifies a user's association with the target workspace, and compute receives only time-limited, scoped-down tokens for the specific data a user is entitled to.
• Certified and compliant. The platform is independently audited against standards including SOC 2 Type II; ISO 27001, 27017, 27018, and 27701; HIPAA; PCI-DSS; and FedRAMP. See the Databricks Security and Trust Center for the current list.

Getting started

• Set up account-level SSO with MFA and use SCIM to automate user provisioning and de-provisioning — see the security best-practices guide.
• Model access in Unity Catalog with least-privilege grants, and use ABAC tags to enforce policies at scale.
• Protect sensitive rows and columns with row filters and column masks, and configure network controls such as PrivateLink.
• Review the Databricks Security and Trust Center to benchmark your configuration.

FAQs

Who controls who can access data in Databricks?

You do. Unity Catalog is the central authorization engine, and administrators grant least-privilege access with role-based and attribute-based access control. Permissions are enforced at the SQL engine level, so the same rules apply across notebooks, SQL, jobs, BI tools, and Genie.

Can I hide specific rows or columns from some users?

Yes. Row filters restrict which rows a user can see, and column masks transform sensitive values before they are returned. Both are evaluated at query time, so they cannot be bypassed, and they apply consistently across SQL, notebooks, jobs, and BI tools.

How do you keep access limited to trusted users and networks?

Access requires account-level SSO with multi-factor authentication, and SCIM automatically de-provisions departed users. Front-end PrivateLink, IP access lists, and egress controls restrict access to trusted networks.

How is access to our data audited?

Unity Catalog records centralized audit logs of who queried what and which policies applied, and credential and storage access is captured in your cloud provider's audit logs — giving you a complete record for monitoring and compliance.