Azure Compliance ControlsAzure Databricks
Databricks workspaces should be in a customer-managed virtual network
Databricks workspaces should be deployed in a customer-managed virtual network to ensure that the workspace is not accessible from the public internet.
What this control checks
Databricks workspaces should be in a customer-managed virtual network
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
- 2.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
- 2.1.9 Ensure 'No Public IP' is set to 'Enabled'
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_deployed_in_custom_vnet - Powerpipe Control:
azure_compliance.control.databricks_workspace_deployed_in_custom_vnet - Prowler Check:
databricks_workspace_vnet_injection_enabled - Azure Policy Definition:
9c25c9e4-ee12-4882-afd2-11fb9d87893f - KICS Query:
05d6b52e-11ca-453d-bb3a-21c7c853ee92
Last reviewed: 2026-10-11