Registering an ADLS Gen2 account as an external location in Unity Catalog requires three steps in a specific order:

Step 1: Create a Databricks Access Connector. This Azure resource wraps a system-assigned or user-assigned managed identity. It is the credential-less authentication bridge between Databricks and Azure Storage — no SAS tokens or access keys are stored anywhere in the workspace.

Step 2: Create a Storage Credential in Unity Catalog that references the Access Connector. This object tells Unity Catalog ' use this identity when accessing storage. ' The Storage Credential is the reusable authentication object.

Step 3: Create an External Location that maps a Unity Catalog path to the specific ADLS Gen2 container using the Storage Credential. This is the object that grants Databricks users access to files under that path, and it respects the principle of least privilege by scoping access to a specific container.