Databricks workspaces should have 'No Public IP' set to 'Enabled'
Enable secure cluster connectivity (also known as no public IP) on Azure Databricks workspaces. Clusters do not have public IP addresses and communicate with the control plane over a secure connection.
Without secure cluster connectivity, Databricks compute nodes are assigned public IP addresses and are directly reachable from the internet. This enables port scanning, lateral movement from a compromised node, and data exfiltration that bypasses private-network controls.
What this control checks
Passes when the workspace's No Public IP setting is Enabled
Common pitfalls
No Public IP must be set at creation
No Public IP must be set at creation; it cannot be enabled on an existing workspace.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Databricks Clusters should disable public IP" (51c1490f-3319-459c-bbbc-7f391bbed753); Prowler check databricks_workspace_no_public_ip_enabled (prowler azure --checks databricks_workspace_no_public_ip_enabled); PowerPipe control azure_compliance.control.databricks_workspace_no_public_ip_enabled.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security).
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.20 Network security
- 2.1.9 Ensure 'No Public IP' is set to 'Enabled'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_no_public_ip_enabled - Powerpipe Control:
azure_compliance.control.databricks_workspace_no_public_ip_enabled - Prowler Check:
databricks_workspace_no_public_ip_enabled - Azure Policy Definition:
51c1490f-3319-459c-bbbc-7f391bbed753
Last reviewed: 2026-10-11