ABAC DENY policy

In the Ultra Transcenders books

DBX-DEP

Each book explains ABAC DENY policy in context, with comparison tables and the common traps.

Terms in this definition

• Exclusions

  Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.

• MANAGE ACCESS CONTROL

  A privilege under MANAGE for granting and revoking access, handing over ownership and looking after ABAC policies. Currently an ABAC DENY policy can take it away, but nobody can be granted it.

• Governed tags

  Tags defined at account level and controlled by a tag policy that sets permitted values and who can apply them. Catalogs and schemas pass them down to child objects (columns do not inherit them), and ABAC policies use them as the attributes to match.

• Object owner

  Every Unity Catalog securable, and every workspace object such as a job or warehouse, has exactly one owner (IS OWNER), which can be a user, a group or a service principal. That owner holds every capability on the object, though child objects do not inherit the ownership.

• Authorisation code

  OAuth 2.0 grant used by native and web apps: the user signs in, and the app then acts on their behalf with delegated permissions.

• Get

  Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.

• ROUND

  Takes a number in DAX to a set count of digits, where a half always moves away from zero. Rounding before comparing Decimal Number values helps head off floating-point surprises.

• Legacy

  A label Databricks gives to older agent offerings: their documentation remains so that existing agents can be kept running or migrated, but new agents should avoid them.

Related terms

• Not allowed resource types

  Built-in Deny policy that prevents the resource types you list from being deployed by any route, including ARM templates.