SAP Databricks admin guide
This article explains the responsibilities of admins in an SAP Databricks account.
There are three types of admin roles available on SAP Databricks:
- Account admin: Has admin privileges across the SAP Databricks account
- Workspace admin: Has admin privileges inside an SAP Databricks workspace
- Metastore admin: Has admin privileges across all data in the account's metastore
Account admin responsibilities
Account admins can do the following in their SAP Databricks account:
- Create new workspaces
- Configure networking controls
- Manage users, groups, and service principals at the account level
- Assign metastore privileges
Access the account console
The account console is where account admins manage their SAP Databricks account.
You can log into the account console at accounts.cloud.databricks.com or by clicking the workspace selector at the top of the SAP Databricks workspace UI and selecting Manage account.
Workspace admin responsibilities
Workspace admins have the following privileges in their workspaces:
- Manage access control for all workspace objects like notebooks and queries
- Create and manage serverless SQL warehouses
- Manage identities
- Access the account's system tables
- Create external location connections to S3 storage
Access the admin settings
Workspace admins are the only users who have access to the workspace's admin settings page. As a workspace admin, you can access admin settings by clicking your username in the top bar of the SAP Databricks workspace and selecting Settings.
Metastore admin responsibilities
The metastore admin is an optional, but highly privileged user or group in Unity Catalog. Account admins can assign the metastore admin role to any user in their account.
Because your account storage is managed by SAP, metastore admins must not update certain metastore configurations. For a full list, see Metastore management.
Metastore admins have the following privileges:
CREATE CATALOG: Allows a user to create catalogs in the metastore.CREATE EXTERNAL LOCATION: Allows a user to create external locations.CREATE STORAGE CREDENTIAL: Allows a user to create storage credentials.CREATE SHARE: Allows a data provider user to create a share in Delta Sharing.CREATE PROVIDER: Allows a data recipient user to create a provider in Delta Sharing.