During a security audit, the auditors require separation of duties across the company's Databricks deployment. They ask the platform lead to explain which administrator role manages users, groups, and workspaces at the account level, which role manages an individual workspace, and which role manages catalogs and data in the metastore. Which answer is accurate?

1. A. Account admin is the only built-in administrative role; workspace admin and metastore admin are just conventional names that teams use for ordinary groups. 💬 A
2. B. Workspace admin automatically includes metastore admin, so a single role is enough to govern both the workspace and the catalogs in its region. 💬 B
3. C. Account admins manage users, groups, workspaces, and metastores at the account level; workspace admins govern one workspace; metastore admins manage catalogs and data. ✓ C
4. D. All three administrative scopes should be assigned to the same trusted person, which is what the auditors' separation-of-duties requirement expects. 💬 D

Reveal answer

Correct answer: Account admins manage users, groups, workspaces, and metastores at the account level; workspace admins govern one workspace; metastore admins manage catalogs and data.

Reference: https://docs.databricks.com/aws/en/data-governance/unity-catalog/