Prepstellar
Get the app

DP-750 · Getting started

19 cards

Azure Databricks Platform Objects

Swipe, scroll or use ← →

  1. The account is the organization-wide scope

    The first screens of Azure Databricks show two very different places, and confusing them makes every later permission question harder. Start at the top.

    An Azure Databricks account is the top-level construct for managing Azure Databricks across an organization. Account-level responsibilities include identity and access, workspace management, Unity Catalog metastore management, and usage management.

    At account level you manage Examples
    Identity and access Users, groups, service principals, user provisioning
    Workspace management Creating workspaces across multiple regions
    Governance Unity Catalog metastore management
    Usage Billing, compliance, and policies

    An account can contain multiple workspaces and multiple Unity Catalog metastores. The relationship only runs one way: a workspace never contains the account.

    1 / 19

  2. The workspace is where the work happens

    A workspace is the collaboration environment where users run workloads such as ingestion, interactive exploration, scheduled jobs, and machine learning training.

    Keep the scopes distinct: the account coordinates the organization, while a workspace is where a team collaborates and runs work. A workspace is not an identity directory for the whole Azure tenant, and it is not a storage format for tables — those belong to other services and other layers entirely.

    A useful habit: when a question mentions billing, provisioning users, or creating another workspace, you are at account level. When it mentions running a notebook, scheduling a job, or exploring data interactively, you are inside a workspace.

    2 / 19

  3. Quick check

    Which pairing correctly separates the two scopes?

    1. AThe workspace is the top-level construct, and the account is where teams run jobs

      This reverses them: the account sits above workspaces and does not host workload execution.

    2. BBoth terms describe the same environment under two different names in the Azure portal

      They are distinct constructs, and one account can hold several workspaces.

    3. CThe account is the top-level construct, and the workspace is where teams run workloads together

      Right. The account manages the organization, and a workspace is the collaboration environment for running work.

    3 / 19

  4. The metastore governs the data

    A Unity Catalog metastore is the central governance system for data assets such as tables and machine learning models. It is the answer to "who may use this data", not "where does this code run".

    Data in a metastore follows the three-level namespace catalog.schema.object. Read a fully qualified name left to right, from the widest container to the thing itself:

    Level Position What it holds
    Catalog First Schemas
    Schema Second Objects such as tables, views, volumes, and models
    Object Third The table, view, volume, or model itself

    So sales.curated.orders names the orders object, in the curated schema, inside the sales catalog. The order never changes, and no workspace or account name appears in it.

    4 / 19

  5. Quick check

    You see the name `finance.reporting.invoices` in a query. What do the three parts represent, in order?

    1. ACatalog, schema, and object

      Right. Unity Catalog organizes data under the three-level `catalog.schema.object` namespace.

    2. BWorkspace, account, and object

      Accounts and workspaces are management constructs and never appear inside a data name.

    3. CSchema, catalog, and then workspace

      The catalog always comes first, and a workspace is not part of the data namespace at all.

    5 / 19

  6. The metastore governs the data

    A metastore attaches to workspaces, and one metastore can be linked to multiple workspaces in the same region so they share a data view and centrally managed access controls.

    That single sentence solves a common design problem. Two teams can keep their own workspaces — their own notebooks, their own jobs, their own collaboration space — and still see exactly the same governed tables with the same permissions, because one metastore is linked to both.

    The alternatives do not achieve it:

    • Merging both teams into one workspace fixes the data view by destroying the separate collaboration environments.
    • Renaming schemas after each workspace makes the names look consistent without sharing anything.
    • Copying tables into each workspace recreates the synchronization problem the lakehouse removes.
    6 / 19

  7. Quick check

    Two teams work in different workspaces in the same region. They need one governed data view with centrally managed access controls, and they want to keep their separate collaboration environments. What should the design do?

    1. AMove both teams' notebooks into a single shared workspace system-data area

      Merging their assets removes the separate environments the teams asked to keep, and system data is not a sharing mechanism.

    2. BLink one Unity Catalog metastore to both workspaces

      Right. A single metastore can be linked to multiple workspaces in the same region, giving each the same data view and shared access controls.

    3. CRename each team's schemas so they match the team's workspace name

      Renaming changes labels only; it creates no shared governance and no shared data view.

    7 / 19

  8. Keep your progress in the app

    That’s 3 of 9 quick checks. In the app they stay answered, and every lesson remembers where you left off.

    Get the app Keep reading here

  9. Two planes: one manages, one processes

    Azure Databricks operates with a control plane and a compute plane. The split explains what runs in Databricks' own account and what runs where your data is processed.

    The control plane contains backend services managed by Azure Databricks, including the web application. Every screen you click — the workspace browser, the job editor, the SQL editor — is served from there.

    The compute plane is where data is processed. The web application is in the control plane, while the resources that execute data processing are in a compute plane.

    Activity Plane
    Opening the workspace user interface Control plane
    Configuring a job in that interface Control plane
    Executing the notebook the job runs Compute plane
    Reading and writing the data itself Compute plane
    8 / 19

  10. Quick check

    An engineer opens the web interface to configure a workload, then starts the resources that process the data. Which mapping is correct?

    1. AThe interface is served from the compute plane, while the processing runs in the control plane

      This reverses the two planes: the web application is a managed backend service, not a data-processing resource.

    2. BThe interface lives in a metastore, while processing happens in the catalog namespace

      A metastore governs data assets and a namespace names them; neither hosts an interface or executes work.

    3. CThe interface is in the control plane, while the processing happens in the compute plane

      Right. The web application belongs to the control plane and the resources that execute processing belong to a compute plane.

    9 / 19

  11. Where compute actually runs

    Both compute types process data, but they sit in different places, and that placement is what gets tested.

    Serverless resources run in a serverless compute plane in the Azure Databricks account. Databricks creates that serverless compute plane in the same Azure region as the workspace's classic compute plane, with network boundaries that isolate workspaces from each other.

    Classic compute resources run in the customer's Azure subscription and workspace virtual network. New compute resources are created inside each workspace's virtual network, which gives classic compute natural isolation: it runs in your own subscription.

    Serverless compute Classic compute
    Where it runs The Azure Databricks account The customer's Azure subscription
    Network A managed serverless compute plane The workspace virtual network
    What it does Processes data Processes data

    Neither type runs in the control plane, in a metastore, or in a Git folder. Compute always sits in a compute plane; only the side of the boundary changes.

    10 / 19

  12. Quick check

    How does the placement of classic compute differ from serverless compute?

    1. AClassic compute runs in the control plane, while serverless compute runs inside Git folders

      The control plane hosts managed backend services, and a Git folder synchronizes code rather than running workloads.

    2. BClassic compute runs in the customer's Azure subscription, while serverless runs in the Databricks account

      Right. Classic resources are created in the customer's subscription and workspace virtual network, and serverless resources run in a serverless compute plane in the Databricks account.

    3. CClassic compute runs inside the metastore, while serverless runs inside a Unity Catalog schema

      A metastore governs data assets and a schema is a namespace level; neither is a place where compute runs.

    11 / 19

  13. Three kinds of content in a workspace

    Workspace storage is not one undifferentiated bucket. It holds two categories, and both are separate from your data.

    Workspace file system data contains user-managed assets such as notebooks, SQL queries, dashboards, alerts, Git folders, libraries, and small code or configuration files. These are the things people create and manage through the interface: a notebook you wrote, a dashboard you designed, a Python wheel you uploaded, a YAML configuration file.

    Workspace system data includes internally generated items such as query results, job run results, notebook revisions, query plans, and cluster logs. Nobody authors these. They are produced by the platform as a by-product of running work, and they persist beyond the life of a single compute resource.

    12 / 19

  14. Quick check

    Which item is workspace system data rather than a user-managed workspace asset?

    1. AA job run result

      Right. Run results are generated internally by the platform while work executes, alongside query results, notebook revisions, query plans, and cluster logs.

    2. BA Python wheel library

      Libraries such as Python wheels are uploaded and managed by users through the interface.

    3. CA folder attached to a git repository

      Git folders are user-managed assets that sync a project with a supported git provider.

    13 / 19

  15. Three kinds of content in a workspace

    Workspace file system data and workspace system data are separate from the user's governed data objects, such as Unity Catalog tables and volumes. A notebook is therefore an asset that contains work; a table or volume is a governed data object; and compute is what executes processing.

    Item Category Governed by Unity Catalog?
    Notebook, dashboard, alert, library Workspace asset No — it is workspace content
    Job run result, cluster log, query plan Workspace system data No — the platform generates it
    Table, volume, registered model Governed data object Yes — under catalog.schema.object
    Cluster or SQL warehouse Compute No — it processes the data

    Sorting a scenario is a matter of asking three questions in order: did a person author it, did the platform generate it while running, or is it business data under a catalog and schema?

    14 / 19

  16. Quick check

    A team saves its transformation code, reviews the execution result the platform produced, and writes the resulting business data. How are the three items classified?

    1. AThe code is a governed object, the result is an asset, and the data is system data

      Authored code is not governed data, and business tables are not internally generated system data.

    2. BThe code is system data, the result is a governed data object, and the data is a workspace asset

      Notebooks are authored by people rather than generated internally, and a run result is not a governed table.

    3. CThe code is a workspace asset, the result is system data, and the data is a governed object

      Right. A notebook is a user-managed asset, a run result is internally generated system data, and a table is a governed data object.

    15 / 19

  17. Read the first screens

    Put the objects to work as a reading habit. When you see account settings, think organization-wide administration. When you enter a workspace, think collaboration and execution. When a name follows catalog, schema, and object, think governed data in a metastore. When a task runs, identify the compute plane. When you save a notebook, distinguish that workspace asset from the data it reads or writes.

    What you see on screen What it tells you
    User provisioning, billing, metastore assignment You are at account level
    Notebooks, jobs, dashboards, exploration You are inside a workspace
    A three-part data name The object is governed by a metastore
    A running task consuming resources Work is happening in a compute plane
    16 / 19

  18. Quick check

    Which reading of a screen is correct?

    1. AA three-part data name such as `sales.curated.orders` tells you the object is governed by a metastore

      Right. The `catalog.schema.object` namespace is how Unity Catalog organizes governed data assets.

    2. BA billing and user-provisioning page tells you that you are inside a single team workspace

      Billing, compliance, and user provisioning are account-level responsibilities rather than workspace activities.

    3. CA running task consuming cluster resources tells you the work is executing in the control plane

      Execution belongs to a compute plane; the control plane hosts the managed backend services and the web application.

    17 / 19

  19. Key takeaways

    • The account is the top-level scope, and a workspace is a collaboration and workload environment.
    • Unity Catalog metastores govern data through the catalog.schema.object namespace.
    • The control plane hosts managed services, while the compute plane processes data.
    • Workspace assets and system data are separate from Unity Catalog tables and volumes.
    • Serverless compute runs in the Databricks account and classic compute runs in the customer's subscription, but both are compute planes.

    Every later topic — cluster policies, catalog permissions, pipeline deployment — assumes you can place a thing in one of these boxes without hesitating.

    18 / 19

  20. Quick check

    Which summary keeps all four platform objects in their correct roles?

    1. AA metastore contains the account, a workspace stores every table, and the control plane processes the data

      The account sits above metastores, governed tables live under a metastore, and the control plane does not process data.

    2. BAn account contains workspaces and metastores, a metastore governs data, and the compute plane processes it

      Right. That is the containment, the governance responsibility, and the execution responsibility in their correct places.

    3. CAn account runs the notebooks, a workspace governs the tables, and the compute plane manages user provisioning

      Notebooks run on compute, governance belongs to Unity Catalog, and user provisioning is an account-level task.

    19 / 19

  21. 9 quick checks · then the test

    In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

    Take this lesson’s test → Next lesson: Azure Databricks Data Engineering WorkflowGet the app
← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app