# Granting to Groups for Databricks Unity Catalog Databricks is pushing toward group-based grants as the scalable way to manage Unity Catalog access. To align with this direction and avoid running into Databricks privilege limits as environments grow, Immuta is changing how we instrument grants behind the scenes by transitioning from direct user grants to group grants for group-based access paths. This is a back-end update that does not have any consumer-facing impact. However, there is one significant administrative change, which is that granting to groups requires Immuta to have workspace admin privileges.
Current model: direct user grants

Databricks access control is based on principals (users, service principals, and groups) rather than database roles. In our current Databricks integration, Immuta effectively manages access at the user level.

  • Users may already have Unity Catalog privileges granted outside of Immuta.
  • Immuta does not have a reliable way to distinguish which specific Databricks privileges on Immuta-managed data were created by Immuta versus granted out of band.
  • When Immuta needs to grant access via an Immuta group, individual Databricks grants are generated for every Databricks user in that group.
New model: group grants

Under the new model, Immuta will treat group-based access as group-based privileges in Databricks.

  • For manual group grants and automatic subscription policies, Immuta will generate one Databricks grant per group (instead of one per user).
  • Immuta will also manage the group’s membership so the right users inherit access via the group.
  • Immuta requires the ability to create and manage Databricks groups and memberships, which requires workspace admin privileges.
  • Immuta-managed groups are created at the account level and not assigned to any particular workspace.

What behavior stays the same:

  • Manual subscriptions to individual users will continue to result in direct user grants.
  • No UI changes, no workflow changes, no concept changes. This is purely a back-end shift in how Immuta issues Databricks grants.
Moving to group grants dramatically reduces the number of privilege entries per securable object. Databricks limits still apply, but the group grants model makes it easier to stay within these limits. * **Direct group memberships**: A principal can be a member of up to 1,500 groups * **Unity Catalog privileges per object**: 4,000 privileges for parent objects and 1,000 privileges for non-parent objects * **Groups per account**: Limit of 250,000 groups for Databricks customers using Account SCIM 2.1. All other Databricks environments are subject to a 5,000 group limit ## Group naming convention When Immuta creates Databricks Unity Catalog groups to enforce access controls, the group naming convention differs slightly based on whether access was granted by an automatic subscription policy or the [group was manually subscribed](#user-content-fn-1)[^1] to the data source. * **Automatic subscription of a user or Immuta group**: The group name comprises the Immuta external ID, the `connectionKey`, and the policy hash. * Naming convention: `IMMUTA___` * Example: `IMMUTA_123456789_UnityCatalogConnection_ce86d2f5f86471f66fcd08741d0eb0f4447a6e73a005094c9da07753a8d630f7` * **Manual subscription of an Immuta group**: The group name comprises the Immuta external ID, the `connectionkey`, and the Immuta group name. * Naming convention: `IMMUTA___MANUAL_` * Example: `IMMUTA_123456789_UnityCatalogConnection_MANUAL_Research` ## Grant the Immuta service principal workspace admin permissions To create and manage groups, this new model requires the Immuta service principal to be a Unity Catalog workspace admin on the workspace you've configured as the host for the integration. To grant the Immuta service principal workspace admin permissions on that workspace, 1. In your Databricks workspace, navigate to **Permissions**. 2. Click **Edit** on your service principal. 3. In the **Role** dropdown that appears, select **Admin**. If your service principal is a Databricks regular user and *not* an actual service principal in Databricks, 1. In your Databricks workspace, navigate to **Settings**. 2. Under **Identity and access**, click **Users** and find the Immuta service principal you created. 3. Under that user’s **Entitlements**, switch the **Admin access** toggle to **On**. [^1]: If a user is manually subscribed to a data source instead of a group, Immuta grants Databricks privileges on the data object directly to that user instead of creating a group. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://documentation.immuta.com/saas/configuration/integrations/databricks/databricks-unity-catalog/how-to-guides/granting-to-groups-for-databricks-unity-catalog.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.