CSA Loom Console

One catalog across your Loom workspaces, Microsoft Purview, and Databricks Unity Catalog — search, govern, and grant access without leaving Loom. (Fabric OneLake is opt-in.)

Permissions

Federated

Grant access to catalog assets without leaving Loom. Pick a source, securable, principal, and role, and the request fans out to the right back-end privileges automatically — Databricks Unity Catalog GRANTs and Fabric/OneLake roles — so one Loom role maps to the native permissions each platform expects. Every grant is a real POST (no mocked principals or fake grants) and the outcome lands in a live, sortable audit log below the form. Use Permissions to provision least-privilege access and to keep a reviewable trail of who was granted what.

One role, mapped to the right privilegesPick a securable, a principal, and a single Loom role. Loom fans the role out to the correct back-end grants automatically — Unity Catalog privileges for Databricks securables, Fabric workspace roles for OneLake — so you never hand-write GRANT statements. Every change is a real backend call and is recorded in the session audit log below.Learn more

Grant a role

Pick a securable, a principal, and a Loom role. Loom maps the role to Unity Catalog privileges or Fabric workspace roles per the table in docs.

Source

Which governed store to grant against.

Loom role

Mapped to back-end privileges automatically.

Workspace hostname

e.g. adb-1234567890.12.azuredatabricks.net

Securable type

The Unity Catalog object class.

CATALOG full name

Three-level name, e.g. main.bronze.customers

SQL warehouse fan-out

Disabled

Issue real GRANT statements via a running warehouse.

Principal

UPN, group object id, or service-principal app id.

Loading the Catalog...