Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIn Databricks, the account is the organization-wide control plane, a workspace is a particular environment for people and workloads, and a Unity Catalog metastore is a regional container for data governance shared by attached workspaces. A separate concept—ownership—applies to individual Unity Catalog objects such as tables and catalogs. These scopes overlap operationally, but none should be treated as a universal owner of everything below it.
How the four scopes differ
| Scope | What it covers | Typical authority |
|---|---|---|
| Account | Organization-wide identity and access, workspaces, metastore creation and assignment, and usage functions | Account admin |
| Workspace | One collaboration and compute environment, including its membership, jobs, and workspace objects | Workspace admin |
| Metastore | One regional Unity Catalog governance container and its metastore-level securable objects | Metastore admin, where assigned |
| Securable object | A specific Unity Catalog object, or a relevant object hierarchy such as a catalog and its children | Object owner or another principal authorized by the privilege model |
Databricks describes the account as the top-level platform construct, which can contain multiple workspaces and metastores. The exact administrative scope depends on the layer, not just on whether someone is called an admin. See Databricks’ high-level architecture and Unity Catalog admin privileges.
As an Amazon Associate I earn from qualifying purchases.
What does the Databricks account control?
The account is the organization-wide layer. Account-level administrators manage identity and access across the platform, create and manage workspaces across regions, create and attach Unity Catalog metastores, and handle usage functions such as billing, compliance, and policies. The account admin role is highly privileged; Databricks recommends distributing it carefully.
Recommended Free Tools
Account administration is not the same as owning every data object. An account admin can have platform-wide authority and may perform actions that affect workspaces or metastores, while Unity Catalog object permissions and ownership remain governed by their own privilege model.
#1 Best Overall
What does a workspace admin control?
A workspace is where users run work such as ingestion, interactive exploration, scheduled jobs, and machine-learning training. A workspace admin’s ordinary scope is that one workspace: its membership, jobs, settings, and workspace objects. This role does not by itself make the person the account admin or owner of every Unity Catalog object.
When Unity Catalog is enabled, the workspace is assigned to a metastore in its region. Multiple workspaces in the same region can attach to one metastore and share a view of its governed data, allowing data stewards to manage access centrally. Enabling Unity Catalog also moves identity management for that workspace to account-level interfaces. See Enable a workspace for Unity Catalog.
What does a Unity Catalog metastore control?
A metastore is the top-level Unity Catalog container for data governance. It registers metadata about securable objects—including tables, volumes, external locations, and shares—and records permissions that govern access. Unity Catalog uses the three-part namespace catalog.schema.table. A workspace must be attached to a metastore in its own region to use Unity Catalog; Databricks says organizations need one metastore for each region in which they operate. See Create a Unity Catalog metastore.
Metastore admin is a metastore-scoped role
A metastore admin governs Unity Catalog for that metastore, including access and ownership for metastore-level objects. The role is distinct from account admin. In many newer workspaces, Databricks describes the metastore-admin role as optional, though particular tasks may require it—for example, taking over objects the workspace admin does not own or removing default workspace-admin permissions. Requirements can vary by account and workspace, so check the current role guidance before making a change.
Rank #3
When a person manually creates a metastore, that person is its initial owner, also called its metastore admin. They can assign the role to another user, group, or service principal; Databricks recommends using a group. See Admin privileges in Unity Catalog.
Who owns a table, catalog, or other securable object?
Every Unity Catalog securable object has an owner. The owner has all privileges on that object, including the ability to grant privileges. That does not mean the owner is an account-wide or workspace-wide administrator. Conversely, an administrator role should not be mistaken for ownership of each object.
Rank #4
Privilege management can also be available to the owner of a containing catalog or schema, a principal with MANAGE on the object, or a metastore admin. The relevant authority therefore depends on the particular object and its place in the hierarchy. Databricks explains the details in Manage privileges in Unity Catalog.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special case: workspace catalogs
If a workspace catalog is provisioned automatically, workspace admins are its default owners and can manage its privileges and child objects. This is a documented special case, not a general rule that workspace admins own all catalogs or data. Also, default privileges on an attached metastore and workspace catalog do not necessarily carry across workspaces when a catalog is shared.
Best Value
How to check or assign a workspace’s metastore
An account admin assigns a workspace to a metastore in the same region. The account console shows the assignment; the workspace configuration can also be checked, and compatible compute can query SELECT CURRENT_METASTORE(). See the workspace enablement guide and Unity Catalog setup guide.
For automation, the Databricks account CLI has an account metastore-assignments command group for creating, retrieving, listing, updating, and deleting workspace-to-metastore assignments. The cited CLI reference is AWS documentation; check the reference and syntax for the CLI version and cloud environment you actually use: account metastore-assignments command group.
What to review before enabling automatic assignment
Databricks supports automatic assignment of newly created workspaces in a metastore’s region. It can simplify provisioning, but changes more than the workspace-to-metastore link. Depending on the configuration, it can create a workspace catalog, grant workspace users default catalog/schema creation privileges, allow workspace admins to create metastore-level securables, expose configured metastore-level storage to the new workspace, and apply the metastore’s OpenSharing setting across attached workspaces.
Review these consequences before enabling the setting, particularly where access to storage or sharing behavior must be limited. The current guidance is in Manage Unity Catalog metastores.
Use the cloud-specific setup guide
The scope model—account, workspace, metastore, and object—is consistent across the cited Databricks documentation, but infrastructure setup is cloud-specific. For example, the cited metastore creation guide is AWS-oriented and covers S3 and IAM role preparation; do not apply those steps unchanged to another cloud provider. Use the guide for the actual cloud and region before changing production configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
