Restricting files/folders to upload into External volumes in Azure databricks UC workspace

Hello Ashwini Gaikwad,

Welcome to the Microsoft Q&A forum.

To upload files to a Unity Catalog volume, You need to have the WRITE VOLUME privilege on the volume you want to upload files to, and the USE SCHEMA and USE CATALOG privileges on the parent schema and catalog, respectively

For disabling file uploads, workspace admins can disable the file upload feature by not granting the WRITE VOLUME privilege to users. This way, users won't be able to upload files to volumes

Reference document: https://docs.databricks.com/en/ingestion/add-data/upload-to-volume.html

To manage the volumes and keep an audit on what is downloaded or uploaded in volumes, you can use Azure Monitor to monitor the activities on the external volumes. You can also use Azure Log Analytics to collect and analyze the logs generated by Azure Databricks workspace and external volumes.

I hope this helps. Please let me know if you have any further questions.

@BhargavaGunnam-MSFT isn't it possible without WRITE VOLUME privilege. Like data engineers can write the files but cannot download or upload it, since considering security reasons they can upload/download anything from their local laptop to and fro from external volumes.

Regards,

Ashwini Gaikwad

The WRITE VOLUME privilege is designed to control both uploading and writing operations on the volume. If you grant this privilege, users will be able to upload files.

if the goal is to allow data engineers to write files to a volume without the ability to download or upload from their local machines, this would require a more granular permissions.

You can try creating a custom role that includes only the permissions they need, excluding upload capabilities(the custom role does not include the WRITE VOLUME privilege)

(Or) you may consider implementing custom solutions that uses services like Azure Functions or Azure Logic Apps to trigger actions or notifications based on specific events or conditions in the data lifecycle.