Databricks workspace uses VNet injection

Check ID: databricks_workspace_vnet_injection_enabled
Provider: Azure
Service: databricks
Severity: HIGH
Categories: trust-boundaries
Resource type: microsoft.databricks/workspaces

What this check verifies

Azure Databricks workspaces using VNet injection are placed in a customer-managed VNet rather than a Databricks-managed network. This evaluates whether a workspace is linked to a customer VNet.

Risk

Using a Databricks-managed VNet limits control over routing, egress, and access boundaries, degrading confidentiality and integrity.

Unrestricted outbound paths enable data exfiltration
Harder to enforce private endpoints and NSG policies
Increased chance of lateral movement into compute nodes

Recommendation

Deploy workspaces in a customer-managed VNet and apply defense in depth:

Enforce egress control with firewalls/NAT and UDRs
Prefer private endpoints to public access
Apply least privilege NSG rules and segregate subnets
Use DNS controls and monitoring to detect anomalies

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az databricks workspace create —name <workspace_name> —resource-group <resource_group_name> —location <region> —sku premium —vnet /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Network/virtualNetworks/<vnet_name> —public-subnet <public_subnet_name> —private-subnet <private_subnet_name>

# Azure Databricks workspace with VNet injection
resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  custom_parameters {
    virtual_network_id  = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>" # CRITICAL: Enables VNet injection by using your VNet
    public_subnet_name  = "<example_resource_name>-public"   # Required: host (public) subnet
    private_subnet_name = "<example_resource_name>-private"  # Required: container (private) subnet
  }
}

// Azure Databricks workspace with VNet injection enabled
resource databricks 'Microsoft.Databricks/workspaces@2023-02-01-preview' = {
  name: '<example_resource_name>'
  location: '<region>'
  sku: { name: 'premium' }
  properties: {
    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'
    parameters: {
      customVirtualNetworkId: { // CRITICAL: Enables VNet injection by attaching your VNet
        value: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>'
      }
      customPublicSubnetName: { value: '<example_resource_name>-public' } // Required: host (public) subnet name
      customPrivateSubnetName: { value: '<example_resource_name>-private' } // Required: container (private) subnet name
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = databricks_workspace_vnet_injection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires