Does Databricks Apps work with Unity Catalog?

Summary

• Yes. Databricks Apps work with Unity Catalog, so an app accesses tables, volumes, and external connections through the same governance layer that secures the rest of your data.
• Every Databricks App has an associated service principal. When you add a Unity Catalog resource to an app, Databricks grants that service principal the privileges it needs on the resource.
• Apps can use Unity Catalog tables, volumes, and connections as governed resources — for example SELECT/MODIFY on tables, READ VOLUME/WRITE VOLUME on volumes, and USE CONNECTION on connections.
• Connection credentials are managed by Unity Catalog and are not exposed to application code; the connection is surfaced to the app through environment variables.
• Access follows Unity Catalog's hierarchical permission model, so an app only reaches data it has been granted, and fine-grained access controls are applied on every request.

Does Databricks Apps work with Unity Catalog?

Yes. Databricks Apps integrate with Unity Catalog, which means an app reads and writes data through the same governed layer that secures the rest of the platform. Rather than embedding credentials or bypassing governance, an app is authorized as an identity with explicit Unity Catalog privileges, and every request is subject to Unity Catalog's access controls.

Why Databricks Apps with Unity Catalog

Databricks Apps use Unity Catalog for identity, resource access, and governed data access.

• A service principal per app. Each Databricks App has an associated service principal. When you add a Unity Catalog resource to the app, Databricks grants that service principal the privileges required to use the resource, so access is explicit and scoped to the app's identity.
• Governed Unity Catalog tables. Apps can access Unity Catalog tables as resources. The app's service principal needs USE CATALOG on the parent catalog, USE SCHEMA on the parent schema, and SELECT or MODIFY on the table — privileges Databricks grants automatically when you add the table resource.
• Read and write Unity Catalog volumes. Apps can read from and write to files in Unity Catalog volumes, with the service principal holding USE CATALOG, USE SCHEMA, and READ VOLUME or WRITE VOLUME as needed.
• Secure external connections. Apps can add Unity Catalog connections as resources to reach external services and data sources. Databricks grants the USE CONNECTION privilege, the connection's credentials are managed by Unity Catalog and are not exposed to application code, and the connection name is surfaced to the app through environment variables.
• Hierarchical, least-privilege permission model. Access follows Unity Catalog's object model and privilege hierarchy, so an app only reaches the catalogs, schemas, tables, volumes, and connections it has been granted, and fine-grained access controls are enforced on every request.

Getting started

• Identify the Unity Catalog tables, volumes, or connections your app needs, and confirm the objects exist under Unity Catalog.
• Add each as a resource to your app so Databricks grants the app's service principal the required privileges — see the docs for tables, volumes, and connections.
• Reference the resource from your app (for example, read the connection name from an environment variable) and grant only the privileges the app actually needs.

FAQs

How does a Databricks App authenticate to Unity Catalog?

Each app has an associated service principal. Adding a Unity Catalog resource to the app grants that service principal the privileges it needs, and the app then accesses data as that identity under Unity Catalog governance.

Which Unity Catalog resources can a Databricks App use?

Apps can use Unity Catalog tables, volumes, and connections. Tables need USE CATALOG, USE SCHEMA, and SELECT/MODIFY; volumes need USE CATALOG, USE SCHEMA, and READ VOLUME/WRITE VOLUME; connections need USE CONNECTION.

Are connection credentials exposed to the app code?

No. Unity Catalog manages connection credentials and does not expose them to application code; the connection name is provided to the app through environment variables.