Key Facts
- What: Databricks has extended Inbound Private Link capabilities to support account-level resources and custom URLs.
- Key Features: Support for account-level Genie One, the Databricks account console, Governance Hub, and account-level APIs.
- Infrastructure: Consolidation of workspace and account-level traffic into a single "General Access" endpoint across multiple regions.
- Availability: Currently in Beta for AWS (Enterprise tier) and Azure (Premium tier); context-based ingress for public access is Generally Available.
Databricks has announced a significant expansion of its Inbound Private Link capabilities, enabling enterprise customers to secure account-level resources including Genie One and the account console within their private cloud networks. The update allows organizations to route user-to-Databricks traffic entirely off the public internet, extending the platform's security framework to cover custom URLs and cross-regional architectures.
By integrating these features into its "context-based ingress" controls, Databricks aims to simplify the networking requirements for large-scale deployments that handle sensitive data.
Securing the Account-Level Ecosystem
The primary shift in this announcement is the transition from workspace-specific private connectivity to a comprehensive account-level model. Previously, Inbound Private Link was primarily focused on individual workspaces. With this update, Databricks is extending these protections to its broader administrative and AI-driven tools.
According to the official announcement, Inbound Private Link now supports account-level Genie One, the Governance Hub, and the account console. This means that when users access the central administrative interface or use Genie One—Databricks’ conversational AI-powered data analytics tool—the traffic remains within the customer's own cloud network. This is a critical requirement for enterprises in highly regulated industries like finance and healthcare, where public internet exposure is often prohibited by internal security policies.
The extension also covers account-level APIs, allowing developers to automate administrative tasks via private network routes rather than relying on public API endpoints.
Architectural Consolidation and Custom URLs
One of the most significant technical shifts included in this release is the move toward endpoint consolidation. In earlier iterations of the platform's networking architecture, customers often had to manage multiple endpoints per region or workspace.
Databricks has now introduced a single shared "General Access" endpoint that can serve all workspace and account-level UIs and APIs across any region. According to the company, this change is designed to reduce the "manual toil and cost" associated with maintaining a sprawling network infrastructure. While teams with strict isolation requirements can still choose to deploy multiple endpoints, they are no longer technically constrained to keep those endpoints in the same region as the resources they serve.
Furthermore, Inbound Private Link now supports custom URLs, such as acme.databricks.com. This functionality extends to Managed Disaster Recovery stable URLs. These stable URLs (e.g., acme.databricks.com/?c=stable-ws-id) ensure that during a failover event, users can maintain connectivity through a consistent address that resolves to the General Access endpoint.
Context-Based Ingress Controls
The new Private Link capabilities are built on Databricks’ context-based ingress engine. This security layer allows account administrators to create granular "allow" and "deny" rules based on three primary factors:
- Identity: Who is making the request?
- Network Source: Is the request coming from a specific public IP or a registered private endpoint?
- Destination: What specific workspace or account-level resource is the user attempting to reach?
Admins can now define these policies for account-level resources using a new "account-policy" configuration. For existing workspace policies, Databricks has added a "private access" section to the context-based ingress settings. This unified policy engine allows for the management of both public and private ingress from a single interface, which Databricks recommends as a replacement for older, "all-or-nothing" IP access lists.
Technical Limitations and Setup
While the General Access endpoint provides significant consolidation, Databricks noted that certain specialized endpoints still require per-region configuration. Specifically, "service-direct" endpoints used for performance-intensive services and "SCC relay" endpoints used for classic-compute secure cluster connectivity must remain region-specific to maintain performance and connectivity standards.
For existing customers, the company stated the update is "additive and non-disruptive." Standard workspace-specific URLs will continue to function alongside new custom URLs. For those looking to enable private access to account-level resources, the process involves two primary steps:
- Registering and allow-listing a General Access endpoint to account-level resources via the context-based ingress account-policy.
- Configuring DNS resolution so that custom URLs point to that General Access endpoint.
Impact on Enterprises and Developers
The expansion of Inbound Private Link directly addresses the complexity of managing AI and data assets at scale. For developers, the ability to use a single endpoint for all UIs and APIs across an organization simplifies the integration of Databricks into corporate network topologies.
For security teams, the inclusion of Genie One in the Private Link fold ensures that AI-driven insights do not create a gap in the organization's "no-public-internet" mandate. The introduction of stable DR URLs also provides a clearer path for business continuity, as network configurations no longer need to be manually updated during regional outages.
What's Next
The new Inbound Private Link capabilities, including support for custom URLs and account-level resources, are currently available in Beta for customers on the AWS Enterprise tier and the Azure Premium tier.
While the private access features remain in Beta, Databricks confirmed that context-based ingress controls for public access have reached General Availability (GA). No specific timeline was provided for when the account-level Private Link features will transition from Beta to General Availability.
Sources
- Databricks Blog: Inbound Private Link now supports account-level Genie One, the account console, and custom URLs
- Microsoft Learn: Use Genie One - Azure Databricks
- Databricks Documentation: Use Genie One | Databricks on AWS
Reader Takeaway: Organizations using Databricks can now consolidate their private networking infrastructure into a single endpoint while extending security protocols to AI tools like Genie One and administrative consoles. Users should verify their tier eligibility (AWS Enterprise or Azure Premium) before attempting to transition to context-based ingress for private resources.