Databricks workspaces should use private endpoints for access
Use private endpoints for Azure Databricks workspaces to allow clients and services to securely access data over an encrypted Private Link. The private endpoint uses an IP address from the VNet for each service.
By mapping private endpoints to Azure Databricks workspaces, you can reduce data leakage risks.
What this control checks
Azure Databricks workspaces need at least one Approved private endpoint connection.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Databricks Workspaces should use private link" (258823f2-4595-4b52-b333-cc96192710d8); PowerPipe control azure_compliance.control.databricks_workspace_uses_private_endpoint.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 2.1.11 (Ensure private endpoints are used to access Azure Databricks workspaces).
Framework mappings
The clauses this control is mapped to in each framework.
- 2.1.11 Ensure private endpoints are used to access Azure Databricks workspaces
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_uses_private_endpoint - Powerpipe Control:
azure_compliance.control.databricks_workspace_uses_private_endpoint - Azure Policy Definition:
258823f2-4595-4b52-b333-cc96192710d8
Last reviewed: 2026-10-11