Back to Checks
azure

Databricks workspace has secure cluster connectivity (no public IP)

databricks_workspace_no_public_ip_enabled
Service: databricksSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.databricks/workspaces

Azure Databricks workspaces are evaluated for secure cluster connectivity (No Public IP / NPIP). When enabled, compute (cluster) nodes are deployed without public IP addresses and communicate with the control plane through a secure relay, reducing the workspace's exposure to the internet.

Prowler logoProwlerprowler-provider-azure

Risk

Without secure cluster connectivity, Databricks compute nodes are assigned public IP addresses and are directly reachable from the internet. This enables port scanning, lateral movement from a compromised node, and data exfiltration that bypasses private-network controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks databricks_workspace_no_public_ip_enabled

Recommendation

Deploy Databricks workspaces with secure cluster connectivity (No Public IP) so compute nodes have no public IP addresses. Because this is set at creation, plan a migration for existing workspaces, and pair it with VNet injection, private endpoints / disabled public network access, and least-privilege NSG rules to uphold defense in depth.

Remediation

CLI

az databricks workspace create --name <workspace_name> --resource-group <resource_group_name> --location <region> --sku premium --enable-no-public-ip

Terraform

# Terraform: Databricks workspace with secure cluster connectivity (No Public IP)
resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  custom_parameters {
    no_public_ip = true # CRITICAL: Deploys cluster nodes without public IP addresses
  }
}

NativeIaC

// Bicep: Deploy a Databricks workspace with secure cluster connectivity (No Public IP)
resource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: {
    name: 'premium'
  }
  properties: {
    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'
    parameters: {
      enableNoPublicIp: {
        value: true // CRITICAL: Deploys cluster nodes without public IP addresses
      }
    }
  }
}

Other

1Sign in to the Azure portal and start creating a new Azure Databricks workspace (No Public IP must be set at creation; it cannot be enabled on an existing workspace)
2On the Networking tab, set Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) to Yes
3Complete the VNet injection configuration if required
4Review + create the workspace
5Migrate workloads to the new workspace and decommission the old one

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.databricks.databricks_client import (
    databricks_client,
)


class databricks_workspace_no_public_ip_enabled(Check):
    """
    Ensure Azure Databricks workspaces have secure cluster connectivity (no public IP) enabled.

    This check evaluates whether each Azure Databricks workspace in the subscription is deployed with secure cluster connectivity (No Public IP / NPIP), so cluster nodes are not assigned public IP addresses.

    Secure cluster connectivity is a classic-compute setting. Serverless workspaces do not expose it (they have no customer-managed cluster nodes with public IPs), so the workspace is reported as MANUAL for verification rather than failed.

    - PASS: The workspace has secure cluster connectivity enabled (no_public_ip_enabled is True).
    - FAIL: The workspace has secure cluster connectivity disabled (no_public_ip_enabled is False).
    - MANUAL: The workspace does not expose the setting (no_public_ip_enabled is None, e.g. serverless workspaces).
    """

    def execute(self):
        findings = []
        for subscription, workspaces in databricks_client.workspaces.items():
            subscription_name = databricks_client.subscriptions.get(
                subscription, subscription
            )
            for workspace in workspaces.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=workspace
                )
                report.subscription = subscription
                if workspace.no_public_ip_enabled is None:
                    report.status = "MANUAL"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not expose secure cluster connectivity (no public IP) settings (for example, serverless workspaces have no public-IP cluster nodes); verify the network configuration manually."
                elif workspace.no_public_ip_enabled:
                    report.status = "PASS"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has secure cluster connectivity (no public IP) enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not have secure cluster connectivity (no public IP) enabled."
                findings.append(report)
        return findings

References