Data access control policy prerequisites

General prerequisites

Complete the following task for all cloud data platforms:

• - Associate the data access control policy with a catalog source type that Data Governance and Catalog supports.

For more information, see Assigning permissions to source systems.

Prerequisites for Databricks

Complete the following tasks for Databricks cloud data platforms:

• - Ensure that the user identified in the catalog source connection that pushes the policies has Databricks workspace admin privileges on the catalog source.
• - Configure a catalog source.

Note: Use a personal access token to connect to your Databricks instance through Data Access Management.

For more information about configuring a catalog source for Databricks, see Register a catalog source.

Prerequisites for Microsoft Power BI

Complete the following tasks for Microsoft Power BI cloud data platforms:

• - For each Microsoft Power BI workspace into which you want Data Access Management to push data access control policies, add the service principal as a member with the Admin permission.
• - Configure a catalog source.
For more information about configuring a catalog source for Microsoft Power BI, see Microsoft Power BI Connection Properties.
• - Grant the following delegated permissions to the connection associated with your Microsoft Power BI cloud data platform:
Dataset.ReadWrite.All
Dataset.Read.All
Workspace.ReadWrite.All
• - Grant the following application permissions to the connection associated with your Microsoft Power BI cloud data platform:
Group.Read.All
GroupMember.Read.All
Note: You must click "Grant admin consent" in Microsoft Power BI to approve application permissions.

Prerequisites for Snowflake

Complete the following tasks for Snowflake cloud data platforms:

• - Configure a catalog source.
For more information about configuring a catalog source for Snowflake, see Snowflake.
• - Grant the following permissions to the connection associated with your Snowflake cloud data platform:
GRANT MANAGE GRANTS ON ACCOUNT TO [IDMC_USER_ROLE];
GRANT CREATE ROLE ON ACCOUNT TO [IDMC_USER_ROLE];