Databricks workspaces should be in a customer-managed virtual network
Databricks workspaces should be deployed in a customer-managed virtual network.
Azure Virtual Networks provide enhanced security and isolation for your Azure Databricks Workspaces, as well as subnets, access control policies, and other features to further restrict access. Using a Databricks-managed VNet limits control over routing, egress, and access boundaries, degrading confidentiality and integrity. Unrestricted outbound paths enable data exfiltration.
What this control checks
Databricks workspaces should be in a customer-managed virtual network
Common pitfalls
Empty or missing custom_parameters fails
Missing "custom_parameters" fails the check. An empty "custom_parameters" block also fails the check.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Databricks Workspaces should be in a virtual network" (9c25c9e4-ee12-4882-afd2-11fb9d87893f); Prowler check databricks_workspace_vnet_injection_enabled (prowler azure --checks databricks_workspace_vnet_injection_enabled); PowerPipe control azure_compliance.control.databricks_workspace_deployed_in_custom_vnet.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - Databricks Workspace Using Default Virtual Network" (05d6b52e-11ca-453d-bb3a-21c7c853ee92).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 3.1.1 (Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)).
CIS Azure Benchmark v5.0.0: Mapped to 2.1.1 (Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)) and 2.1.9 (Ensure 'No Public IP' is set to 'Enabled').
HIPAA Security Rule 2003: Mapped to 164.308(a)(4)(ii)(A) (Isolating health care clearinghouse functions).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
- 2.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
- 2.1.9 Ensure 'No Public IP' is set to 'Enabled'
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_deployed_in_custom_vnet - Powerpipe Control:
azure_compliance.control.databricks_workspace_deployed_in_custom_vnet - Prowler Check:
databricks_workspace_vnet_injection_enabled - Azure Policy Definition:
9c25c9e4-ee12-4882-afd2-11fb9d87893f - KICS Query:
05d6b52e-11ca-453d-bb3a-21c7c853ee92
Last reviewed: 2026-10-11