Skip to main content
Last updated on

Access requests

The request for access (RFA) feature lets users request privileges for Unity Catalog objects from anywhere in Databricks. This page explains how access requests work, where users can request permissions, how requests are routed, and how requesters and reviewers track and review those requests. To configure destinations, see Configure access request destinations.

How does request for access (RFA) work?​

RFA enables governed self-service access to Unity Catalog objects.

How users can request permissions​

When a user attempts to interact with a Unity Catalog object they don't have permissions on, they can request access from several in-product surfaces: Catalog Explorer, SQL editor and notebooks, dashboards, Genie One, and Genie Agents.

Users can request access for themselves, a service principal, another user, or a group.

When a user requests a privilege such as SELECT, Databricks automatically checks prerequisite privileges (USE CATALOG and USE SCHEMA). If any are missing, Databricks generates additional requests and routes them to the parent objects' approvers.

Catalog Explorer​

Users with the BROWSE privilege can navigate the catalog tree, open an object's page, and request additional privileges. If the user doesn't have the BROWSE privilege, they can be sent a direct URL to the object's page where they can request access.

Request permissions dialog in Catalog Explorer with the principal, privileges, and message.

SQL editor and notebooks​

When a query or command fails with an INSUFFICIENT_PERMISSIONS error, the error message includes a Request access option that pre-fills the request with the referenced tables.

SQL query failing with an INSUFFICIENT_PERMISSIONS error and a Request access affordance.

Dashboards​

When a dashboard runs without embedded credentials and the user lacks access to the underlying datasets, the widget surfaces a Request access modal.

AI/BI dashboard widget prompting the viewer to request access to missing datasets.

Genie One​

When Genie One needs to read a table the user doesn't have access to, it helps the user file the request for access. By default, Genie One prepares a SELECT request on the user's behalf. If an admin configured a redirect URL, Genie One shows the link.

Genie One Review access request dialog with the table, reviewers, SELECT privilege, and justification.

Genie Agents​

When a Genie Agent connects to data sources that the user lacks permissions on, the agent displays a PERMISSION_DENIED banner with a Request access modal for the inaccessible tables.

Genie agent with a Request access modal listing inaccessible tables.

How requests are routed​

When users request access to an object in Unity Catalog, the request is sent to one or more configured destinations. If multiple destinations are configured on an object, the request is routed to all of them.

For the list of access request destinations and how they work, see destination types and how destinations are resolved.

What happens after a request is submitted​

After a request is submitted, requesters can track its status, and reviewers can approve or decline it. A request stays open until a reviewer acts on it or it expires:

  • After 3 days: Email reminders are sent to the original email destinations. Slack, Microsoft Teams, webhook, and redirect URL destinations don't receive reminders.
  • After 7 days: Unanswered requests expire.

Track access requests​

Requesters, reviewers, and metastore admins can track requests from the Requests page in Catalog Explorer. The Requests entry appears for users who have at least one incoming or outgoing request, and always appears for metastore admins.

  1. In your Databricks workspace, click Data icon. Catalog.
  2. On the Catalog Explorer homepage, click Requests.
  3. Select a view from the drop-down menu:
    • My requests: Requests you submitted, including on behalf of groups or service principals, and requests others submitted for you. Available to any user.
    • Review queue: The requests routed to you, available to any user whose email address is set as a destination. Provision or decline requests from this queue.
    • All requests: A metastore-wide track record of every request and its current state. Available to metastore admins.

Catalog Explorer Requests page showing the Review queue with request statuses.

Databricks doesn't import approvals made outside of Databricks. Requests routed to an external system show as Managed externally.

Databricks retains tracked requests for 365 days from when they're submitted. Resolving a request doesn't reset this period.

For a record of every access request and destination configuration, see Request for access events in the audit log reference.

Review an access request​

To review an access request, follow the link sent to your access request destination, or open the request from the Review queue on the Requests page. See Track access requests. Databricks checks that the reviewer has permission to grant access when they approve a request. However, any user who opens the review link and signs in to the workspace can decline it.

Review access request summary with request details and Decline and Provision buttons.

To grant the request, click Provision, and then select one of the following approval methods:

  • Add principal to group(s): Use group membership to grant access. If your groups are identity provider-synced, you can still grant access this way, but the membership change doesn't sync back to your identity provider or close the request there.
  • Grant privileges to principal: Grant the privilege directly. The principal can be a group.

Approval method options to add the principal to groups or grant privileges directly.

To decline the request, click Decline and enter a mandatory reason.

Decline an access request by entering a required reason for the requester.

When a reviewer approves or declines a request, the requester and the user the request was made for receive a notification email.

On this page