Permission dependencies

Some permissions only work when a role also grants another one. For example, a user with Update on Manage Silver Entities still can’t save an entity unless they can also update the pipeline it belongs to. Use the tables below when you build a role, or when a user has a permission but the related button is missing, disabled, or fails when they use it. Feature names match the permission matrix. All records means the permission applies to every connection or pipeline, not to specific records.

The permission matrix turns on a group’s top-level feature, such as Instance Settings, and Admin App Access when you grant any permission inside the group. It doesn’t add Read when you grant Update, so add both where a table lists both.

Data Connections

To do this	You need	Also needed
Open any page of a connection	Manage Data Connections: Read on that connection	Without it, the page shows as not found
See a connection you just created	Manage Data Connections: Create	Manage Data Connections: Read on the new connection, and Manage Data Connection Resources: Read to see its tables. Creating a connection doesn’t grant access to it.
View a connection’s tables, routes, or files	Manage Data Connection Resources: Read	Manage Data Connections: Read on that connection
View a resource’s collection page	Manage Data Connection Resources: Read	Manage Data Connections: Read on that connection
Open the Auth tab	Manage Data Connection Settings: Read	Manage Data Connections: Read on that connection
Edit a connection’s authentication details	Manage Data Connections: Update on that connection	Manage Data Connection Settings: Read, to open the Auth tab
Open a connection’s collection settings	Manage Data Connection Settings: Update	Manage Data Connections: Read on that connection
Attach a schedule in collection settings	Manage Data Connection Settings: Update	Manage Data Connections: Update
Trigger Deletion or Trigger Sync in collection settings	Manage Data Connections: Update on that connection	Manage Data Connection Settings or Manage Data Connection Resources: Update, to open the settings
View the Schedules page	Manage Data Connection Settings: Read	Manage Data Connections: Read
Create, edit, or delete a schedule	Manage Data Connection Settings: Update	Manage Data Connections: Create, Update, or Delete, matching the action
View a connection’s Emission tab	Manage Data Connection Settings: Read	Manage Data Connections: Read on that connection
Create or edit an emitter on a connection	Manage Data Connections: Update on that connection	None
Delete an emitter	Manage Data Connections: Update on that connection	Manage Data Connections: Delete

Manage Data Connection Settings and Manage Data Connection Resources apply to every connection. They only take effect on connections the user can also read under Manage Data Connections.

Data Pipelines

To do this	You need	Also needed
Open a pipeline	Manage Production Pipelines or Manage Dev Pipelines: Read on that pipeline	Without it, the pipeline shows as not found. The `main` pipeline always uses Manage Production Pipelines.
Save, publish, or reset an entity, or revert it to a snapshot	Manage Silver Entities or Manage Gold Entities: Update	Update on the pipeline the entity belongs to
Revert a change from the entity history	Manage Silver Entities or Manage Gold Entities: Update	Update on the pipeline
Sync an entity to another pipeline	Manage Silver Entities or Manage Gold Entities: Update	Update on the target pipeline
Add or edit a map on a gold entity	Manage Gold Entities: Update	Manage Silver Entities: Update. Without it, saving the map fails.
Use the row actions on an entity with access control	Permissions on the entity’s layer	Manage Access Control Entity Rules: Update. Without it, the row menu is empty.
Sync a pipeline	Update on that pipeline	Manage Silver Entities: Update
Sync from Main	Manage Production Pipelines: Read on all records	Manage Silver Entities: Update, and Update on the target pipeline
Duplicate a pipeline	Update on the pipeline you duplicate	None. Create isn’t required.
View the Metrics library	Manage Metrics: Read	Read on the pipeline
View Emissions in a pipeline	Manage Data Connections: Read on all records	Without it, you’re sent back to the pipeline
Create an emitter from a pipeline	Manage Data Connections: Update on all records	Update on the pipeline
Edit an emitter from a pipeline	Update on the pipeline	Manage Data Connections: Update on that emitter’s connection

Instance Settings

To do this	You need	Also needed
Use any instance settings card	Update on the card’s feature	Read on the same feature. Without Read, the card is hidden.
Open the network connections list	Manage System Network Connection: Update	Manage System Network Connection: Read
Add a network connection	Manage System Network Connection: Create	Manage System Network Connection: Update. Without it, saving fails.
Open the firewall rules page	Manage Firewall Rules: Update	Manage Firewall Rules: Read
Add a firewall data source or policy	Manage Firewall Rules: Create	Manage Firewall Rules: Update. Without it, saving fails.
Apply Changes to firewall rules	Manage Firewall Rules: Update	Manage System Version: Read and Update
Save Lakehouse IP Access	Manage Databricks IP Access: Update	Manage System Version: Read and Update. Without them, applying the change fails.
Save the instance timezone	Instance Settings: Access	Manage System Version: Update

Access Control

To do this	You need	Also needed
Use the Groups or Users pages	Manage Access Control Groups: Read	Manage Production Pipelines: Read on the `main` pipeline, and Manage Silver Entities: Read. Without them, the page says a production pipeline or mapped entities are required.
Create a group	Manage Access Control Groups: Create	Manage Access Control Groups: Update
Use the Filters tab when creating a group	Manage Access Control Groups: Create and Update	Manage Production Pipelines: Read and Manage Silver Entities: Read
Test Permissions on a group	Manage Access Control Groups: Read	Manage Access Control Entity Rules: Read
Create a rule	Manage Access Control Entity Rules: Create	Manage Access Control Entity Rules: Update
Pick users or groups in a rule	Manage Access Control Entity Rules: Create or Update	Manage Access Control Groups: Read. Without it, the picker stays empty.
Pick specific resources in a rule	Manage Access Control Entity Rules: Create or Update	Manage Access Control Entity Rules: Read. Without it, the picker stays empty.
Use subject or resource filters in a rule	Manage Access Control Entity Rules: Create or Update	Manage Production Pipelines: Read and Manage Silver Entities: Read
Test Permissions on the rules page	Manage Access Control Entity Rules: Read	Manage Access Control Groups: Read, for the subject picker
Change a default permission	Manage Access Control Entity Rules: Update	Manage Access Control Entity Rules: Read, to load the current value
Edit Display Fields	Manage Production Pipelines: Update on the `main` pipeline	Manage Silver Entities: Update. Manage Access Control Entity Rules isn’t used.
Open the Data Sources pages	Access Control: Access	Manage Access Control Entity Rules: Read
Create a data source configuration	Manage Access Control Entity Rules: Create	Manage Access Control Entity Rules: Update
Open a data source’s collection settings	Manage Data Connections: Read on that connection	Manage Data Connection Resources: Read to load them. To save, Manage Data Connection Settings: Update and Manage Data Connection Resources: Update.

Application Permissions

To do this	You need	Also needed
Assign or revoke a user’s roles	Manage Users: Update	None
Save a user’s edited permissions as a new role	Manage Users: Update	Manage Roles: Create
Duplicate a role	Manage Roles: Create	None

Troubleshooting

If a user has a permission but the feature still doesn’t work, find the task in the tables above and check that their roles grant everything in the Also needed column. Remember that roles are additive: the user needs the permission from at least one assigned role. Changes take effect within about a minute.

Roles and permissions

Create roles and assign them to users

Troubleshooting

Common issues and solutions for user management

Users

Instance Administration

Instance Onboarding

Data Connections

Data Pipelines

Instance Settings

Access Control

Application Permissions

Troubleshooting

Roles and permissions

Troubleshooting

​Data Connections

​Data Pipelines

​Instance Settings

​Access Control

​Application Permissions

​Troubleshooting

​Related documentation

Roles and permissions

Troubleshooting

Data Connections

Data Pipelines

Instance Settings

Access Control

Application Permissions

Troubleshooting

Related documentation