Does Unity Catalog support row-level security and column masking?

Summary

• Yes. Databricks Unity Catalog supports both row-level security (row filters) and column masking (column masks) as core fine-grained access controls. They are generally available on Databricks Runtime 12.2 LTS and above. See Announcing GA of row and column level security in Unity Catalog.
• A row filter is a SQL user-defined function (UDF) evaluated on each row at query time; rows where it returns FALSE are excluded. Apply it with ALTER TABLE ... SET ROW FILTER.
• A column mask is a SQL UDF that takes a column value and returns the original or a masked version. Apply it with ALTER TABLE ... ALTER COLUMN ... SET MASK.
• Filters and masks add restrictions on top of object-level GRANT privileges and are enforced consistently across Databricks SQL, notebooks, jobs, and connected BI tools, with every query captured in lineage and audit logs.
• For governance at scale, Unity Catalog also offers attribute-based access control (ABAC), applying policies via governed tags at the catalog, schema, or table level. See the Unity Catalog docs.

Does Unity Catalog support row-level security and column masking?

Yes. Databricks Unity Catalog provides both row-level security and column masking as built-in, fine-grained access controls, and both are generally available on Databricks Runtime 12.2 LTS and above. Instead of maintaining duplicate regional tables or multiple filtered views, you define access logic once as a SQL function and attach it to a table. See the row filters and column masks documentation and Announcing GA of row and column level security in Unity Catalog.

Why Databricks Unity Catalog for row-level security and column masking

• Row filters (row-level security). A row filter is a SQL user-defined function (UDF) that evaluates each row at query time; rows where the function returns FALSE are excluded from results. You apply it with ALTER TABLE ... SET ROW FILTER (or at CREATE TABLE). This is used to restrict users to records for a specific region, department, or account.
• Column masks. A column mask is a SQL UDF that takes a column value as input and returns either the original value or a masked version. Each column can have one mask, and a mask can reference other columns to vary its behavior. You apply it with ALTER TABLE ... ALTER COLUMN ... SET MASK.
• Identity-aware logic. Filter and mask functions can reference the caller's identity and group membership using functions such as is_account_group_member() and session_user(), so the same table returns different rows and values depending on who is querying it.
• Layered on top of GRANT. Row filters and column masks do not grant access on their own — they add restrictions on top of object-level privileges. You still grant base table access separately with GRANT, and the filter or mask further narrows what each user sees.
• Consistent, governed enforcement. Because the controls live in Unity Catalog, they are enforced consistently across Databricks SQL, notebooks, jobs, and connected BI tools, and every query is captured in Unity Catalog lineage and audit logs.
• Dynamic views as an alternative. For view-based patterns, dynamic views let you redact or filter data with SQL expressions and the same group-membership functions.
• Attribute-based access control (ABAC) for scale. Beyond per-table filters and masks, Unity Catalog supports ABAC: attach policies using governed tags at the catalog, schema, or table level so a single policy applies across many tables and individual table owners cannot bypass it. See when to use ABAC vs table-level row filters and column masks.

Getting started

• Read the row filters and column masks documentation for syntax and requirements.
• Create a SQL UDF for your access logic, then attach it with ALTER TABLE ... SET ROW FILTER or ALTER TABLE ... ALTER COLUMN ... SET MASK.
• For organization-wide enforcement, follow the ABAC guidance to apply tag-based policies at the catalog or schema level.
• Review the GA announcement blog for background and examples.

FAQs

Does Unity Catalog support row-level security?

Yes. Row-level security is implemented as row filters — SQL UDFs evaluated per row at query time, applied with ALTER TABLE ... SET ROW FILTER. Rows where the function returns FALSE are hidden from the user.

Does Unity Catalog support column masking?

Yes. Column masks are SQL UDFs that take a column value and return the original or a masked version, applied with ALTER TABLE ... ALTER COLUMN ... SET MASK. Each column can have one mask.

Are row filters and column masks generally available?

Yes. Row filters and column masks are generally available in Unity Catalog on Databricks Runtime 12.2 LTS and above.

Do row filters and column masks replace GRANT permissions?

No. They add restrictions on top of object-level privileges. You still grant base table access with GRANT, and the filter or mask further limits which rows and column values each user can see.

How is enforcement kept consistent across tools?

Because the controls are defined in Unity Catalog, they apply consistently across Databricks SQL, notebooks, jobs, and connected BI tools, and every query is captured in lineage and audit logs.