Cross-workspace access

Cross-workspace access controls serverless network traffic between Azure Databricks workspaces. Account admins use it to decide which workspaces can reach a given workspace and which workspaces a workspace's serverless workloads can send traffic to. This lets you connect workspaces that need to share data or services while keeping every other workspace isolated.

Important

Cross-workspace access is in Beta.

You configure cross-workspace access on the network policy assigned to a workspace. Each policy controls traffic in two directions:

Traffic between two workspaces flows only when both policies agree: a request is allowed only when the source workspace's egress rules permit the destination and the destination workspace's ingress rules permit the source. Configure both sides for any workspace pair that must communicate.

Requirements

  • You must be an account admin.
  • Your Azure Databricks account and workspaces must be on the Premium tier.

How cross-workspace access works

Cross-workspace access uses the same network policies as context-based ingress control and serverless egress control. Cross-workspace rules identify each workspace by its numeric workspace ID:

  • On the ingress side, cross-workspace rules act as an additional network source. They use the same identities and allow and deny rules as other network sources on the context-based ingress policy. See Network sources.
  • On the egress side, you list the destination workspaces your workloads are allowed to reach. The egress side is an allowlist only.

Same-workspace traffic is always allowed and is not affected by these rules. The source and destination workspaces can be in the same or different Azure Databricks accounts.

Limitations

  • Cross-workspace access applies to serverless workloads only. It does not govern classic compute traffic.
  • Cross-cloud access is not supported.
  • Cross-region cross-workspace Lakebase access is not supported.

Configure cross-workspace ingress access

Cross-workspace ingress access controls which source workspaces can reach a workspace over serverless traffic. Configure it on the workspace's context-based ingress policy. For an overview of context-based ingress, see Context-based ingress control.

On a network policy's Ingress tab, a Compatibility mode checkbox determines whether the policy governs cross-workspace ingress. Policies are in Compatibility mode by default:

  • When Compatibility mode is selected, the policy does not govern cross-workspace ingress and keeps the workspace's current behavior; its pre-existing network controls apply.
  • When you clear Compatibility mode, the policy exposes the cross-workspace access modes and the allow and deny rule editor.

To configure cross-workspace ingress access in the account console:

  1. From the account console, click Security.
  2. Click the Networking tab, then open the network policy you want to edit.
  3. Select the Ingress tab.
  4. Clear the Compatibility mode checkbox.
  5. Select a cross-workspace access mode:
    • Allow access from all serverless source workspaces in any account (FULL_ACCESS): Any serverless source workspace can reach this workspace.
    • Restrict access to specific source workspaces (RESTRICTED_ACCESS): Access is denied by default. A request is allowed only when it matches an allow rule, and denied when it matches a deny rule.
  6. For Restrict access to specific source workspaces, add allow or deny rules that match a list of selected workspace IDs. To reference a source workspace in another account, paste its numeric workspace ID and add it.
  7. Click Save.

Configure cross-workspace egress access

Cross-workspace egress access controls which Azure Databricks workspaces your serverless workloads can send traffic to. Configure it on the workspace's serverless egress network policy. For an overview of serverless egress control, see What is serverless egress control?.

The egress side behaves as an allowlist. You list the destination workspaces your workloads can reach, and every other Azure Databricks workspace stays blocked while the policy restricts access. There is no egress deny rule for Azure Databricks destinations.

Allowed destinations are part of the network policy's egress rules, so you configure them in the same Network Access Policy editor that governs the policy's other outbound access. To reference a workspace in another account, use its numeric workspace ID.

To allow cross-workspace destinations in the account console:

Open the network policy

  1. From the account console, click Security.
  2. Click the Networking tab, then open the network policy you want to edit.
  3. Select the Egress tab.

Restrict egress access

Under Network access, select Restricted access to specific destinations. The Allowed Databricks workspace destinations section appears only when access is restricted. If you select Allow access to all destinations, serverless workloads can reach any destination and cross-workspace rules do not apply.

Add the destination workspaces

  1. In the Allowed Databricks workspace destinations section, click Add workspace.
  2. In the Add workspace destination dialog, use the Workspaces picker to select the workspaces to allow. To reference a workspace in another account, paste its numeric workspace ID and add it.
  3. Click Add.

The workspaces you add appear in a table listed by Workspace ID. To remove a destination, use the delete action on its row.

Save the policy

Set the policy enforcement mode, then save the policy. In dry run mode, policy violations are logged but not blocked, which lets you confirm that every required destination is allowed before you enforce the policy.

You can also configure allowed Azure Databricks destinations with the network policies REST API. See Manage network policies for serverless egress control.

Next steps

  • Last updated on