Databricks IP Whitelist Guide

Databricks workspaces can be secured with IP access lists so that only approved networks are able to reach the workspace. In VDAB, a Databricks connection needs to call the Databricks workspace APIs in order to browse catalogs, use SQL warehouses, work with jobs, and power Databricks-backed app components.

This guide walks you through allowing VDAB to connect to your Databricks workspace by adding VDAB’s published static IP addresses to your Databricks allow list.

Use this option when your organization is comfortable keeping the Databricks public workspace endpoint enabled, as long as that endpoint is restricted to approved IP addresses. If your Databricks workspace must remain private and public access cannot be enabled, use the private Azure endpoint proxy guide instead.

Before you begin, make sure you have Databricks Workspace Admin access, permission to update the Azure Databricks workspace networking settings, the current VDAB static egress IP addresses from Xorbix, the admin or corporate IP addresses that still need Databricks UI access, and the Databricks App Connection values used by VDAB.

1. Get the VDAB IP Addresses

To start, you will need the current VDAB static egress IP addresses, and Xorbix will provide these values.

If Xorbix provides more than one IP address, add all of them. Keep these IP addresses available for the Databricks allow list step.

2. Enable Public Network Access for Databricks

Next, confirm that your Azure Databricks workspace can accept traffic through the public workspace endpoint.

In the Azure Portal, open the Azure Databricks workspace resource.

1. Select Networking.
2. Set Public Network Access to Enabled.
3. Save the change.

This does not remove any Private Link or private endpoint configuration you already use for internal access. It adds a public path that can be restricted with Databricks IP access lists.

Before continuing, confirm with your security or Databricks administration team that IP-restricted public access is approved for this workspace.

3. Add VDAB to the Databricks IP Access List

Now, open the Databricks workspace as a workspace admin and add the VDAB IP addresses to the workspace allow list.

1. In Databricks, open Settings.
2. Go to Security or Network, depending on your Databricks workspace UI.
3. Open IP access lists.
4. Create or update an allow list named VDAB SaaS Egress.
5. Add all current VDAB static egress IP addresses.
6. Add any corporate, VPN, office, or administrator IP addresses that still need access to the Databricks UI.
7. Enable the allow list.

Adding administrator IP addresses is important. If only the VDAB IP addresses are added, your Databricks administrators may lose access to the workspace UI from their normal networks.

If your workspace also uses block lists, confirm that the VDAB IP addresses are not blocked. Databricks block lists take precedence over allow lists.

4. Configure the Databricks App Connection

VDAB uses a Databricks App Connection for OAuth authorization. This lets users authorize VDAB to access the Databricks workspace through Databricks-supported authentication.

In Databricks, open or create the App Connection that will be used by VDAB.

1. Grant the API access required for the Databricks features you plan to use in VDAB.
2. Copy the Client ID.
3. Copy the Client Secret.
4. Note the Access Token TTL and Refresh Token Lifespan.

The workspace URL used in VDAB should be the normal Databricks workspace URL, such as:

https://adb-0000000000000000.00.azuredatabricks.net.

5. Add the Databricks Workspace in VDAB

Now the Databricks workspace is ready to be added to VDAB.

In VDAB, open Databricks Connections and add or edit the workspace connection.

1. Enter a Workspace Display Name, such as Production Workspace.
2. Enter the standard Databricks Workspace URL, such as https://adb-0000000000000000.00.azuredatabricks.net.
3. Enter the Databricks App Connection Client ID.
4. Enter the Databricks App Connection Client Secret.
5. Enter the Access Token TTL from Databricks.
6. Enter the Refresh Token Lifespan from Databricks.
7. Save the connection.

After saving, select Authorize on the workspace card and complete the Databricks authorization flow.

6. Confirm the Connection Works

After authorization is complete, the workspace card in VDAB should show that the connection is authorized.

Use VDAB to browse Databricks catalogs, schemas, tables, jobs, or another Databricks feature you plan to use in your app. In Databricks audit logs, you should see the request coming from one of VDAB’s published egress IP addresses.

Also confirm that your Databricks administrators can still access the Databricks workspace UI from their approved corporate, VPN, or administrator networks.

Security Checklist

Before using the connection for production VDAB apps, confirm the following items:

• Public network access was approved by your Databricks or security owner.
• The VDAB production or staging egress IP addresses are current.
• Corporate, VPN, office, or administrator IP addresses were added before enforcing the allow list.
• No broad ranges such as 0.0.0.0/0 were added.
• Databricks block lists do not block VDAB’s egress IP addresses.
• The Databricks App Connection credentials are stored in VDAB and rotated according to your organization’s policy.
• Your team has a process for updating the allow list if VDAB egress IP addresses change.

Troubleshooting

If VDAB cannot reach the workspace, confirm that public network access is enabled on the Azure Databricks workspace.

If VDAB receives a 403 response from Databricks, confirm that all current VDAB egress IP addresses are included in the Databricks allow list and that none of them are blocked by a Databricks block list.

If Databricks administrators cannot access the workspace UI, confirm that the correct corporate, VPN, office, or administrator IP addresses are included in the allow list.

If OAuth fails with invalid_client, confirm that the Client ID and Client Secret in VDAB match the current values from the Databricks App Connection.

If the integration worked previously and then stopped, compare the Databricks allow list with the latest VDAB egress IP addresses provided by Xorbix.