Skip to main content

REVOKE DATA_ADMIN

Description​

Remove a principal from the organization's data admin set. See the permissions documentation for more details.

Data adminship is org-wide, so there is deliberately no ON <object> clause. To revoke a privilege on one object, use REVOKE PRIVILEGE.

Only a data admin can remove a data admin

Only an existing data admin can add or remove a data admin. Being an account admin or project admin does not by itself let you change this list. See What changes when data admins are enabled for who is a data admin by default.

Syntax​

REVOKE DATA_ADMIN FROM <principal_type> '<principal_identifier>'

Examples​

REVOKE DATA_ADMIN FROM USER 'steve@apple.com'

REVOKE DATA_ADMIN FROM GROUP 'data_platform'

REVOKE DATA_ADMIN FROM SERVICE_PRINCIPAL 'governance_sp'

Required parameters​

  • principal_type: Specify one of {USER|GROUP|SERVICE_PRINCIPAL}.
  • principal_identifier: Specify one of {<user_email>|<group_id>|<service_principal_id>}.

If the principal cannot be resolved, the statement fails with Principal not found: <principal_identifier>.

Notes​

  • Adminship held through a group counts. Revoking DATA_ADMIN from a user does not remove adminship they hold through a group — revoke it from the group, or remove them from the group.
  • Revoking data adminship does not change any privileges the principal was granted with GRANT PRIVILEGE; those still apply.

To add a data admin, use GRANT DATA_ADMIN.