Databricks workspaces should have 'Allow Public Network Access' set to 'Disabled'
Checks that each Databricks workspace has the `Allow Public Network Access` setting set to `Disabled`. Disabling public network access prevents exposure to the internet and ensures the workspace isn't exposed on the public internet.
Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. You can control exposure of your resources by creating private endpoints instead.
What this control checks
Databricks workspace publicNetworkAccess must be Disabled
Common pitfalls
Policy effect can be Audit, Deny or Disabled
The policy effect parameter allows Audit, Deny or Disabled, with a default of Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Databricks Workspaces should disable public network access" (0e7849de-b939-4c50-ab48-fc6b0f5eeba2); PowerPipe control azure_compliance.control.databricks_workspace_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_158.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 2.1.10 (Ensure 'Allow Public Network Access' is set to 'Disabled').
Framework mappings
The clauses this control is mapped to in each framework.
- 2.1.10 Ensure 'Allow Public Network Access' is set to 'Disabled'
Related controls
- PostgreSQL servers should have public network access disabled
- Databricks workspaces should have diagnostic log delivery configured
- Storage accounts should prohibit public access
- Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks
- Azure SignalR Service should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_public_network_access_disabled - Checkov Check:
CKV_AZURE_158 - Powerpipe Control:
azure_compliance.control.databricks_workspace_public_network_access_disabled - Azure Policy Definition:
0e7849de-b939-4c50-ab48-fc6b0f5eeba2
Last reviewed: 2026-10-11