Azure Compliance ControlsAzure Databricks
Databricks workspaces should have 'Allow Public Network Access' set to 'Disabled'
Checks that each Databricks workspace has the `Allow Public Network Access` setting set to `Disabled`. Disabling public network access prevents exposure to the internet and ensures the workspace isn't exposed on the public internet.
What this control checks
Databricks workspace publicNetworkAccess must be Disabled; any other value fails.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.1.10 Ensure 'Allow Public Network Access' is set to 'Disabled'
Related controls
- PostgreSQL servers should have public network access disabled
- Databricks workspaces should have diagnostic log delivery configured
- Storage accounts should prohibit public access
- Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks
- Azure SignalR Service should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_public_network_access_disabled - Powerpipe Control:
azure_compliance.control.databricks_workspace_public_network_access_disabled - Azure Policy Definition:
0e7849de-b939-4c50-ab48-fc6b0f5eeba2
Last reviewed: 2026-10-11