Create and manage governed tags

This page explains how to create and manage governed tags across your account. For an overview of governed tags, see Governed tags.

Create a governed tag

To create a governed tag, you must have the CREATE permission at the account level. Account and workspace admins have CREATE by default.

1. In your Azure Databricks workspace, click Catalog.

2. Click the Governed Tags > button.

3. Click Create governed tag.

4. Enter a tag key.

   Tag keys are case sensitive. For example, Sales and sales are two distinct tags.

5. Optionally, enter a description for the governed tag.

6. Optionally, enter one or more allowed values for the tag. Only these values can be assigned to this tag key.

   

7. Click Create.

Governing existing tag assignments

If you create a governed tag with the same key as tags that are already assigned to objects, all existing tag assignments with that key automatically become governed. You do not need to reassign them.

For example, suppose several tables already have a tag with the key department and various values, such as finance, engineering, and marketing. These tags are currently ungoverned, so any user with the APPLY TAG privilege can assign them or modify their values.

If you create a governed tag with the key department and define the allowed values as finance, engineering, marketing, and sales, the following happens:

• All existing department tag assignments on those tables become governed immediately.
• Going forward, only users with the ASSIGN privilege on the department governed tag can assign or modify department tag values.
• Tag values are restricted to the allowed values you defined (finance, engineering, marketing, sales).
• Existing tag assignments that use values outside the allowed list are not removed, but they cannot be reassigned with the same out-of-policy value.

If you later delete the governed tag, all tag assignments with that key become ungoverned. This means that any user with the APPLY TAG privilege can assign or modify those tag values without requiring the ASSIGN privilege.

Edit a governed tag

To edit a governed tag, you must have the MANAGE permission on that governed tag.

1. In your Azure Databricks workspace, click Catalog.

2. Click the Governed Tags > button.

3. Select the governed tag.

4. To edit the description, click the pencil icon .

5. To add an allowed value, click Add value.

6. To remove an allowed value, select the checkbox next to the value and click Remove value.

Delete a governed tag

When you delete a governed tag, the tag itself is not removed from objects. Instead, it becomes ungoverned. This means:

• The tag key and any existing tag values remain on objects.
• The tag is no longer subject to a tag policy.
• Anyone with the ability to apply tags can assign or modify the tag without requiring special permissions.

To delete a governed tag, you must have the MANAGE permission on that governed tag.

1. In your Azure Databricks workspace, click Catalog.

2. Click the Governed Tags > button.

3. Select the governed tag.

4. Click Delete.