Databricks releases, every cloud
- Unused OAuth client secrets are automatically deleted after 90 days
Deletes unused secrets after 90 days, create new if still needed.
- Data Classification now scans Unity Catalog views (Beta)
Scans Unity Catalog views in addition to tables, using the same detection engine, and is currently in Beta.
- External secrets in Unity Catalog (Beta)
Connects Unity Catalog schema to AWS Secrets Manager, appearing as read-only objects.
- Restrict service principal OAuth secrets to specific API scopes
Restricts OAuth secrets to specific API scopes like sql or jobs, limiting leaked secret impact.
- Unity Catalog Skills (Beta)
Publishes and governs agent skills, controlling access with Unity Catalog permissions.
- Context attributes in ABAC column mask and row filter policies (Beta)
Targets request context, such as OAuth client ID and on-behalf-of status, in Unity Catalog policies.
- Run the change, do not just read it. Hands-on labs in your own Databricks workspace, graded when you submit. Browse labs
- Identity attributes in ABAC column mask policies (Beta)
Targets users by attributes like department or country, using has_identity_attribute_value and has_identity_attribute_tag_match functions.
- Block or redact sensitive data in requests and responses
Detects SSNs, credit cards, and phone numbers using regex and checksums. Requires Enhanced Unity Gateway preview.
- Cross-workspace access for serverless (Beta)
Controls serverless network traffic between workspaces with ingress and egress rules.
- Tags page in Governance Hub (Beta)
Provides a centralized view of tag usage, summarizes governed tags, and offers recommendations for invalid values. Requires account admins to enable from Previews page.
- Define business concepts with Pages (Beta)
Gives business terms a single governed definition, part of Unity Catalog semantics.
- ABAC GRANT policies now cover Unity Gateway resource types (Beta)
Supports model services, model provider services, MCP services, and agent services, allowing tag-based access.
- READ METADATA privilege is GA
Provides read-only visibility into security-sensitive metadata, including privilege grants and ABAC policies.
- Tag automations (Beta)
Assigns or removes governed tags on Unity Catalog tables or volumes based on defined conditions.
- Refresh materialized views and streaming tables without exempting the pipeline owner from ABAC policies
Pipeline owners are now subject to ABAC policies when refreshing views and tables. Policies are evaluated using the pipeline owner's identity.
- Secrets in Unity Catalog is GA
Stores secrets as securable objects with Unity Catalog privileges. Uses catalog.schema.secret namespace.
- Upcoming general availability of Unity Gateway Coming soon
Extends Unity Catalog governance to runtime interactions, controls AI service usage, and monitors traffic. Available by default for workspaces with compliance security profile in mid-September.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Automated setup for S3 external locations
Uses AWS IAM temporary delegation to configure external locations and provision required resources.
- Get this table by email. One Monday mail covering the week, filtered to the clouds and products you run. Weekly digest
- Databricks-hosted sample datasets available in the samples catalog
Available in Unity Catalog-enabled workspaces through OpenSharing as samples.databricks.datasets.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Allowlist partner platform IPs in context-based ingress control (Beta)
Supports Power BI, Tableau Cloud, and dbt platform, with automatic IP list updates.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Change to default pipeline editor for workspaces with the compliance security profile enabled Coming soon
Replaces legacy editor, removing it in August.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Govern LLMs in Unity Catalog with model services (Beta)
Represents a governed LLM endpoint, sharable across workspaces via Unity Catalog privileges.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed VPC will soon be required for classic workspaces Coming soon
New classic workspaces will require a customer-managed VPC, replacing Databricks-managed VPC.
- Comments on foreign tables (Beta)
Syncs table and column comments from external data sources to Unity Catalog foreign tables.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Private Link for account-level resources (Beta)
Connects account console through VPC interface endpoint instead of public internet. Requires configuration.
- Email notifications for expiring service principal tokens (Beta)
Sends emails to workspace admins when tokens expire in 7 days, requiring no configuration.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - ABAC GRANT policies for models (Beta)
Grants EXECUTE privilege on models based on governed tags, supporting MLflow and foundation models.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - AWS Graviton instances are now supported with the compliance security profile
Supports all compliance standards in AWS commercial regions and GovCloud.
- Column popularity is now available in the Catalog Explorer
Shows column query count in the Overview tab, determined by read queries.
- Cross-engine attribute-based access controls (Beta)
Enforces row filters and column masks server-side for external engines reading Unity Catalog tables.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed keys for Lakebase available in all AWS and Azure regions
Encrypts project data at rest using a custom cloud KMS key. Available for new projects.
- Customer-managed keys now support MLflow managed evaluation features
Supports MLflow 3 scorers and requires non-CMK encrypted catalog.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Databricks Add-in for Excel support for all compliance security profile standards
Supports all Databricks compliance security profiles. Requires Public Preview.
- HIPAA support for the Databricks Add-in for Excel
Available for workspaces with HIPAA compliance across all supported regions.
- Graviton instance types are available for the compliance security profile
Graviton instances improve price-performance for many workloads on AWS Commercial workspaces with FedRAMP Moderate, IRAP, or CCCS Medium compliance standards.
- Automatic identity management
Syncs users and groups from identity providers like Microsoft Entra ID and Okta.
AWS, read it on their docsAzure(not on this cloud)GCP, read it on their docsSAP, read it on their docs - Connect Databricks to on-premises resources using an SSH reverse tunnel
Uses proxy VMs in AWS, replacing inbound firewall access.
- Tag Unity Catalog functions
Requires Databricks Runtime 18.1 or above. Uses SET TAG and UNSET TAG commands.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Recently Resolved Incidents section in Data Quality Monitoring (Beta)
Shows automatically recovered unhealthy tables, including resolution time.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Workspace object permissions will soon be inherited from all account groups Coming soon
Inherited permissions include inactive grants from removed groups, potentially giving unexpected access. Users still need workspace assignment.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud)
Headlines, dates and product areas are Databricks' own, from the release notes published for each cloud, and every item links to the note it came from. The one-line summaries are ours. Not a Databricks product and not affiliated with Databricks, Inc.