You have an Azure Databricks workspace that is enabled for Unity Catalog.

For authentication, a Managed Identity (via a Databricks Access Connector) is the right choice. The Access Connector wraps an Azure-managed identity so Databricks can authenticate to Azure Storage without any credentials being stored in the workspace. The cloud security team controls the identity through Azure RBAC — there are no secrets to rotate or leak inside Databricks.

For the permission, READ FILES on the volume is exactly right. It allows users to read and list files through the volume path while blocking writes, deletes, and modifications. This is the minimum necessary access, honouring the principle of least privilege.

WRITE FILES would allow modifications, contradicting ' users can access but NOT modify. ' ALL PRIVILEGES grants far more than needed. Service principals with stored client secrets would mean credentials inside Databricks, violating the ' does not require storing credentials ' requirement.