Set up Lakewatch access control

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Setting up groups, a run-as service principal, and Unity Catalog grants is the recommended way to configure Lakewatch access control for a security team. This guide sets up a single Lakewatch catalog with four groups that separate ingestion, detection authoring, and analyst duties under least privilege. A single user who already has access to the underlying data can use Lakewatch without this setup. To choose between the single-user and team-based models, see Deployment models.

The grants use lakewatch as the catalog and lakewatch.prod as the schema. Replace them with your own names, and replace <sp> with the run-as service principal's applicationId.

Personas

The setup provisions four groups, one per role on a typical security team. Groups are recommended but optional. You can grant the same privileges to any Unity Catalog principal.

Group	Role
`lakewatch-admins`	Administer Lakewatch: manage resources, settings, and access for others.
`lakewatch-data-engineers`	Onboard and maintain datasources and land data into tables.
`lakewatch-detection-engineers`	Author and tune detection rules and review what they produce.
`lakewatch-analysts`	Work the alert queue: read alerts, update status, and query data.

Prerequisites

Account admin for step 1. Creating groups, the service principal, and the run-as delegation is an account-level task.
Metastore admin, or CREATE CATALOG on the metastore, for step 2. Account admin does not grant this.
A SQL warehouse and CAN_MANAGE on it for step 4. The warehouse is the compute Lakewatch runs on.
Owner rights on any external location, connection, or source table you grant in step 6.

Run steps 2, 3, 5, and 6 as SQL in a notebook or the SQL editor. Steps 1 and 4 are one-time actions in the account console and workspace UI.

1. Create groups, the service principal, and the run-as delegation

Scheduled datasources and detection rules run as a service principal, so create one and give the groups that operate Lakewatch the right to run resources as it. In the account console:

Go to User management > Groups and create the four groups: lakewatch-admins, lakewatch-data-engineers, lakewatch-detection-engineers, and lakewatch-analysts.
Go to User management > Service principals and create the Lakewatch run-as service principal. Copy its applicationId (a UUID) for use as <sp> in the following steps.
On the service principal's Permissions tab, assign Service Principal Manager to lakewatch-admins.
On the same tab, assign Service Principal User to lakewatch-data-engineers and lakewatch-detection-engineers. This lets members of those groups create resources that run as the service principal.

2. Create the catalog and schema

Create the catalog and schema that hold your Lakewatch resources. Run the following:

CREATE CATALOG IF NOT EXISTS lakewatch;
CREATE SCHEMA IF NOT EXISTS lakewatch.prod;

3. Grant the service principal data access

The run-as service principal needs to read and write data in the schema. To grant its baseline access, run the following:

GRANT USE CATALOG ON CATALOG lakewatch TO `<sp>`;
GRANT USE SCHEMA ON SCHEMA lakewatch.prod TO `<sp>`;
GRANT CREATE TABLE ON SCHEMA lakewatch.prod TO `<sp>`;
GRANT MODIFY ON SCHEMA lakewatch.prod TO `<sp>`;
GRANT SELECT ON SCHEMA lakewatch.prod TO `<sp>`;

4. Grant the service principal Can use on a SQL warehouse

The service principal runs SQL on a warehouse. Granting it use of a warehouse is a workspace permission, not a Unity Catalog grant:

Go to SQL Warehouses and open the warehouse you want Lakewatch to use.
On its Permissions, grant Can use to the service principal. This requires CAN_MANAGE on the warehouse.

5. Grant privileges to each group

Grant each group its privileges on the catalog. Because privileges inherit down the Unity Catalog hierarchy, a grant on the catalog applies to every Lakewatch resource beneath it. For what each privilege allows, see Roles and capabilities.

To grant the admin privileges, run the following:

GRANT USE CATALOG ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT USE SCHEMA ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT MANAGE ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT READ_METADATA ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT SELECT ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT MODIFY ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT CREATE_DATASOURCE ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT CREATE_RULE ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT CREATE_SECRET ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT READ_SECURITY_DATA ON CATALOG lakewatch TO `lakewatch-admins`;
GRANT UPDATE_SECURITY_DATA ON CATALOG lakewatch TO `lakewatch-admins`;

To grant the data engineer privileges, run the following:

GRANT USE CATALOG ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT USE SCHEMA ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT CREATE_DATASOURCE ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT CREATE_SECRET ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT SELECT ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT MODIFY ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT CREATE TABLE ON CATALOG lakewatch TO `lakewatch-data-engineers`;
GRANT CREATE SCHEMA ON CATALOG lakewatch TO `lakewatch-data-engineers`;

To grant the detection engineer privileges, run the following:

GRANT USE CATALOG ON CATALOG lakewatch TO `lakewatch-detection-engineers`;
GRANT USE SCHEMA ON CATALOG lakewatch TO `lakewatch-detection-engineers`;
GRANT CREATE_RULE ON CATALOG lakewatch TO `lakewatch-detection-engineers`;
GRANT READ_METADATA ON CATALOG lakewatch TO `lakewatch-detection-engineers`;
GRANT READ_SECURITY_DATA ON CATALOG lakewatch TO `lakewatch-detection-engineers`;
GRANT SELECT ON CATALOG lakewatch TO `lakewatch-detection-engineers`;

To grant the analyst privileges, run the following:

GRANT USE CATALOG ON CATALOG lakewatch TO `lakewatch-analysts`;
GRANT USE SCHEMA ON CATALOG lakewatch TO `lakewatch-analysts`;
GRANT READ_SECURITY_DATA ON CATALOG lakewatch TO `lakewatch-analysts`;
GRANT UPDATE_SECURITY_DATA ON CATALOG lakewatch TO `lakewatch-analysts`;
GRANT SELECT ON CATALOG lakewatch TO `lakewatch-analysts`;
GRANT READ_METADATA ON CATALOG lakewatch TO `lakewatch-analysts`;

6. Grant access to sources (optional)

Grant these only for the sources you use. Each requires that you own the securable you grant on.

To let the service principal read from an external location, run the following:

GRANT READ FILES ON EXTERNAL LOCATION <external_location> TO `<sp>`;

To let the service principal use every connection in the metastore, run the following:

GRANT USE CONNECTION ON METASTORE TO `<sp>`;

To let the service principal read an existing source table, run the following:

GRANT USE CATALOG ON CATALOG <src_catalog> TO `<sp>`;
GRANT USE SCHEMA ON SCHEMA <src_catalog>.<src_schema> TO `<sp>`;
GRANT SELECT ON TABLE <src_catalog>.<src_schema>.<src_table> TO `<sp>`;

7. Verify

Confirm the grants landed. To list the grants on the catalog and schema, run the following:

SHOW GRANTS ON CATALOG lakewatch;
SHOW GRANTS ON SCHEMA lakewatch.prod;

Limitations

Granting USE CONNECTION ON METASTORE lets the service principal use every connection in the metastore, which is broader than least-privilege. Use it only on a metastore dedicated to Lakewatch.

Feedback

Was this page helpful?

Last updated on 2026-10-16