CAN MANAGE

In the Ultra Transcenders books

DBX-GENAI

Each book explains CAN MANAGE in context, with comparison tables and the common traps.

Terms in this definition

• View

  Shows a system through one chosen group of related concerns. No view is generic; each one is tied to whichever architecture it depicts.

• CAN QUERY

  Lets the holder query a serving endpoint. In the permission ladder, it is one step up from CAN VIEW and one below CAN MANAGE.

• Databricks

  Analytics platform built on Apache Spark where data is processed in notebooks; Unity Catalog is the governance model it recommends.

• App protection policy

  A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.

• Unity Catalog

  Azure Databricks' governance solution covering both data and AI in one place, with centralised permissions, auditing, data discovery and lineage.

• MANAGE

  A Unity Catalog privilege allowing a principal to grant and revoke access on an object, hand over its ownership and drop it, all without being the owner. It gives no data access by itself and is not part of ALL PRIVILEGES.

Related terms

• Azure Deployment Stack Contributor

  Can manage deployment stacks, but has no right to add or remove deny assignments; an Azure built-in role.

• CAN EDIT

  A permission on workspace objects, notebooks for example, that allows editing them. Altering who has access to the object requires CAN MANAGE instead.

• CAN MONITOR

  Meant for power users, this permission on a SQL warehouse is stronger than CAN USE but weaker than CAN MANAGE. It allows running queries and watching the warehouse, for example through its history of queries and their profiles.

• GCP

  Google's public cloud. With a GCP account, Self-Service can manage applications running there.

• Inbound permissions

  Access levels controlling use of a serving endpoint, separate from anything it reaches outbound. CAN VIEW shows it in lists, CAN QUERY permits calling it too, and CAN MANAGE extends to editing, deleting and permission changes.

• Private DNS Zone Contributor

  Built-in Azure role that can manage private DNS zones yet has no rights over virtual networks. Linking a zone to a VNet therefore also requires virtualNetworks/join/action granted on that network.

• SQL Server Contributor

  Built-in role that can manage databases and logical servers, including setting the Microsoft Entra admin. Switching Microsoft Entra-only authentication on or off is beyond it, though Contributor or SQL Security Manager can do so.

• Veeam Agent for IBM AIX

  Protects computers running IBM AIX. Paired with the Solaris agent it makes up Veeam Agent for Unix, and the backup server can manage it via protection groups.