How Blueprint Informatica Migration Workbench implements enterprise-grade access control with Unity Catalog
In enterprise software, security, governance, and compliance are non-negotiable. Multi-tenant applications serving sensitive migration data require robust access controls that align with organizational hierarchies and regulatory requirements.
At Blueprint, we’ve built the Blueprint Informatica Migration Workbench as a Databricks App with enterprise-grade security at its foundation. The platform implements fine-grained access control through Unity Catalog, ensuring teams only access workflows they’re authorized to migrate while maintaining complete audit trails for compliance.
Built on Databricks’ native security model, this approach eliminates the complexity of building custom authentication infrastructure while providing granular permissions, role-based access control, and comprehensive audit logging.
An overview of the security architecture
The Blueprint Informatica Migration Workbench implements a multi-layered security model with Unity Catalog as the central governance layer. The platform separates user-initiated operations from systeminitiated operations, ensuring proper separation of duties.
User authentication flows through Databricks’ native OAuth-based system, eliminating separate login screens. The app retrieves user identity and entitlements automatically, validating this context against Unity Catalog permissions.
Backend operations like triggering Lakeflow Jobs use a dedicated service principal rather than user credentials. Service principal credentials are stored securely in Databricks Secrets.
Every user action is logged to Unity Catalog Delta Lake tables. These audit logs include user identity, operation type, timestamps, and outcomes. This provides complete traceability while remaining queryable via SQL.
How does it work?
User authentication and context
When users access the Blueprint Informatica Migration Workbench, the Databricks App automatically establishes their identity through the workspace authentication system. The app retrieves email address, group memberships, and entitlements without requiring separate login flows.
The authentication flow leverages On-Behalf-Of (OBO) tokens, allowing the application to execute queries with the same permissions as the authenticated user. Permission resolution happens in real-time on every page load, ensuring revoked access takes effect immediately.
Fine-grained access control
The platform implements a three-tier permission model: READ access for viewing workflows and dashboards, WRITE access for triggering conversion jobs and validations, and ADMIN access for configuration management.
These permissions are enforced at the Unity Catalog level using standard SQL GRANT and REVOKE statements. The app checks grants before displaying UI elements or executing operations, dynamically rendering the interface based on privileges. Permissions cascade from catalog to schema to table, allowing granular control over specific migration projects.
Service principal operations
Backend operations like triggering Databricks Workflows and managing job orchestration use a dedicated service principal rather than user credentials. This ensures automated processes continue running regardless of user session state and prevents privilege escalation.
The service principal authenticates via client ID and secret stored in Databricks Secrets. Separate WorkspaceClient instances are created for user versus service principal operations, ensuring clear boundaries. Jobs API calls bypass OBO authentication to ensure reliability. Scheduled workflows complete successfully even when the initiating user is offline.
Comprehensive audit logging
Every user action is logged to Unity Catalog tables, creating an immutable audit trail for compliance and security investigations. The ActivityLogManager writes structured log entries capturing user identity, operation type, affected resources, timestamps, and outcomes.
Audit logs are stored in Delta Lake tables, making them queryable via Databricks SQL for compliance reporting. Security teams can identify failed operations, trace user activity, or generate audit reports for SOC2 or regulatory reviews. Because Delta Lake maintains complete transaction history, logs cannot be modified without leaving a trace. This provides tamper-proof evidence for compliance audits.
User authentication flow diagram showing Databricks workspace auth → App → Unity Catalog permission check
Key features of the security model
Unity Catalog-native permissions
Rather than building a custom permission system, the Blueprint Informatica Migration Workbench leverages Unity Catalog’s built-in access controls. Administrators grant privileges using standard SQL GRANT statements. The app queries these grants at runtime using the SHOW GRANTS command to determine access rights.
This eliminates custom authentication infrastructure, user databases, or permission tables. Permissions are consistent across all Databricks tools. The same Unity Catalog grants apply whether users access data through the Migration Workbench, Databricks SQL, or Python notebooks. The security model integrates with enterprise identity providers via SAML and SCIM.
A single GRANT statement controls access to both source Informatica metadata and converted PySpark notebooks. Revoked access takes effect immediately across all applications without requiring cache flushes.
Separation of user and service principal contexts
The application distinguishes between user-initiated and system-initiated operations. User operations authenticate with OBO tokens that enforce Unity Catalog grants. System operations like triggering Lakeflow Jobs use a dedicated service principal with carefully scoped permissions.
This prevents users from executing privileged operations beyond their grants. A user with READ-only access cannot circumvent permissions. The service principal validates WRITE access before accepting job trigger requests. Automated workflows continue running independently of user sessions.
Service principal credentials are stored in Databricks Secrets with restricted access policies. The service principal is granted minimal required permissions. It can trigger jobs and write to specific Unity Catalog tables but cannot read sensitive workflow data or modify user permissions. Separate secret scopes are maintained for development, staging, and production environments.
The audit trail distinguishes user actions from system actions, supporting compliance investigations and security reviews.
Immutable audit trails
All activity logs are written to Delta Lake tables in Unity Catalog, providing an immutable audit trail. Once written, log entries cannot be modified without leaving a trace in the Delta transaction log.
Delta Lake’s time-travel capabilities enable security teams to query historical activity. Compliance auditors can reconstruct migration operations, identifying who accessed what data using standard SQL syntax.
Organizations can build real-time security monitoring views that alert on unauthorized access attempts. Example audit query:
-- View all migrations triggered by a specific user
SELECT * FROM {catalog}.migration_assessment.activity_log
WHERE user_email = 'user@company.com'
AND operation_type = 'workflow_conversion'
ORDER BY timestamp DESC;Role-based UI rendering
The application dynamically adjusts its user interface based on the authenticated user’s permissions. Users with READ-only access see dashboards and reports but cannot trigger jobs. The “Convert Workflow” button simply doesn’t appear, preventing confusion.
WRITE users gain access to conversion features and job execution controls. ADMIN users see the Settings page for catalog configurations and system integrations. This progressive disclosure ensures users only see features they’re authorized to use.
Permission checks occur on every page load, ensuring revoked access takes effect immediately. The UI itself becomes a security control, guiding users toward authorized workflows and preventing unauthorized actions before they’re attempted.
Why this matters
Traditional custom-built migration tools often implement ad-hoc authentication systems, relying on database credentials, shared API keys, or basic auth. These approaches introduce security risks including credential leakage, privilege escalation, and lack of integration with enterprise identity providers. Audit trails are afterthoughts, stored in flat files or siloed databases that can’t be queried systematically.
The Blueprint Informatica Migration Workbench eliminates these risks by building on Databricks Apps and Unity Catalog. Teams leverage existing identity infrastructure, such as SAML, SCIM, and workspace integrations already deployed. Permissions align with organizational policies using familiar GRANT syntax. Audit trails integrate seamlessly with compliance reporting tools.
This delivers measurable business impact: Faster deployment with no need to build custom auth systems, authentication works from day one. Reduced risk from leveraging a proven security model tested across thousands of Databricks customers. Compliance confidence with immutable audit trails meeting SOC2, GDPR, and HIPAA requirements. Operational simplicity through centralized permission management.
For migration teams, this means more time validating business logic and less time troubleshooting authentication. For security teams, confidence that migration operations meet the same governance standards as production pipelines. For compliance officers, audit-ready trails without custom infrastructure.
The future of secure data applications
As organizations migrate more workloads to the Databricks platform, building applications with securityfirst architecture becomes critical. The Blueprint Informatica Migration Workbench demonstrates how
Databricks Apps can deliver enterprise-grade security without sacrificing developer productivity or user experience.
This architecture establishes patterns for the next generation of Lakehouse applications. Identity is inherited, not reimplemented. Permissions are declared, not hard-coded. Audit trails are queryable, not siloed. These principles extend beyond migration tools to any enterprise application built on Databricks, from data science workbenches to customer-facing analytics platforms.
It’s not just about securing one migration tool. It’s about establishing patterns and best practices for building secure, compliant, multi-tenant applications on Databricks. This approach sets a new standard for how enterprise data applications should handle authentication, authorization, and audit logging in the Lakehouse era.
