Skip to main content
TechExplainedTechExplained
|
How-toLevel: Advanced

How to connect Azure Databricks to Microsoft Purview

Registering and scanning Unity Catalog from Purview, including the permissions on the system tables and the difference between the two connectors.

TechExplained 2 min readPublished: 10 August 2026Last updated: 10 August 2026
#purview#unity catalog#governance#lineage#how-to
Architect walking a team through the five steps to connect Azure Databricks to Microsoft Purview, with the connector choice, the system table permissions and Key Vault on screen
All how-tos
  1. 01

    Pick the right connector

    Purview has two Databricks connectors and they are not interchangeable. The Azure Databricks Unity Catalog connector is the one you want if you use Unity Catalog. The older Azure Databricks connector covers the Hive metastore and exists for those who have not migrated yet.

    Watch the difference in what they can do, because it catches people out:

    Unity Catalog connectorHive metastore connector
    Full scanyesyes
    Incremental scanyesno
    Scoped scannoyes

    That means the Unity Catalog connector does not let you narrow part of your environment in the scan configuration, but does let you run incrementally every day. With the older connector it is exactly the other way around. So if you are used to scoped scans and you move over, you have to rethink your scan strategy.

  2. 02

    Sort out the permissions in Purview

    In Purview you need both the Data Source Administrator and the Data Reader role on the collection where you register the source. Both, not one of the two. Without Data Reader you can register but not scan.

  3. 03

    Sort out the permissions in Databricks

    Purview does not read lineage from an API but directly from the Unity Catalog system tables. The account you scan with therefore needs:

    • SELECT on system.access.table_lineage
    • SELECT on system.access.column_lineage
    • USE CATALOG on system
    • USE SCHEMA on system.access

    This is the step most often skipped. The scan will succeed, but your lineage stays empty and nobody immediately sees why.

  4. 04

    Put the secret in Key Vault

    Authentication runs through a secret you store in Azure Key Vault and register as a credential from Purview. So Purview needs access to that Key Vault too. Arrange it in the same pass, because a half-registered credential produces a scan error that says very little about the cause.

  5. 05

    Register, scan and verify

    Register the source in the right collection, run a full scan first and then check three things: are the catalogs, schemas and tables in the Data Map, is lineage populated, and is classification correct on the columns you expected to be sensitive.

    Decision
    put the incremental scan on a schedule afterwards, not on a person. A scan you start by hand is a scan that has not run in two months.

What to do next

Make sure your Unity Catalog layout itself is in order before you start scanning, because Purview reflects what is there and does not improve it. See How to set up Unity Catalog.

The process at a glance

Click a step for its key decision

Step 1

Pick the right connector

This step has no explicit decision, but builds on the previous one.

Read next

How to connect Azure Databricks to Microsoft Purview | TechExplained