Unity Catalog governance and connections
Frequently asked questions about Unity Catalog connection scope, cross-workspace access, and which governance objects Atlan imports from Databricks.
Frequently asked questions about how Atlan connects to Unity Catalog, what it imports, and which governance objects stay inside Databricks.
What is Unity Catalog and how does Atlan connect to it?
Unity Catalog is Databricks' governance layer for data and AI assets. Atlan connects at the metastore level through a Unity Catalog-enabled workspace. You need one Atlan connection per metastore; a single connection covers all catalogs, schemas, and tables visible to the service principal within that metastore.
How does Atlan handle multiple workspaces that share metastore?
When multiple workspaces share the same metastore, a single Atlan connection reads across all of them using a common service principal with access to each workspace. Public catalogs are accessible from any workspace; private catalogs are read from the workspace that owns them.
When you have multiple metastores, each requires a separate Atlan connection.
For setup steps and current limitations, see Cross-workspace extraction.
What governance objects stay inside Unity Catalog and aren't represented in Atlan?
The following are enforced inside Unity Catalog and aren't imported into Atlan:
- GRANT statements and access control lists (ACLs): who can SELECT, USE, or CREATE within a catalog, schema, or table stays in Unity Catalog and isn't visible in Atlan
- Row filters and column masks: row-level security filters and dynamic data masking rules defined in Unity Catalog aren't crawled
- Audit logs:
system.access.auditevents aren't ingested - Model serving configurations and AI Gateway policies: these aren't crawled
- Workspace-level entitlements and account-level admin roles: not represented in Atlan