Identity attributes

Identity attributes is a Databricks data governance capability, introduced August 2026.

A fixed set of nine attributes (title, userType, locality, region, country, costCenter, organization, division, department) that Databricks stores on account users and syncs from your identity provider, so Unity Catalog ABAC policies can reference who someone is rather than only which group they are in.

• Nine attributes, and nine is the whole list - each one holds a single value, and the docs file multi-valued attributes under "future work". 🔗
• Two of the nine have nowhere to come from on Microsoft Entra ID, which has no native source field for costCenter or division, so they stay unmapped unless you supply a custom extension attribute or expression. 🔗
• Storing the attributes and using them are two separate launches - the ABAC policy functions that consume them (has_identity_attribute_value and has_identity_attribute_tag_match, valid in the WHEN clause of a column mask policy) ship separately from the attributes themselves. 🔗

⚠ Limitations: Beta limitations - supported on users only, with service principals and groups not yet covered; each attribute holds a single value; the attribute control list can only be configured in the account console, with no API to do it programmatically; and on Microsoft Entra ID costCenter and division have no native source field. 🔗

Category

Data governance

Introduced

August 2026🔗

Verified

2026-08-20