Databricks Expands Inbound Private Link to Account-Level Tools

Databricks has introduced major upgrades to its Inbound Private Link service, extending secure, off-internet routing to account-level resources. The update allows enterprise customers to place account-level tools, including Genie One, the account console, the Governance Hub, and account-level APIs, behind their private cloud networks. Additionally, the service now supports custom URLs, such as acme.databricks.com, as well as managed disaster recovery stable URLs.

For cloud architects and administrators, this release significantly reduces infrastructure complexity. Instead of deploying and managing one endpoint per region or workspace, teams can now use a single shared General Access endpoint in any region to serve all workspace and account-level user interfaces and APIs. While performance-intensive service-direct endpoints and secure cluster connectivity relay endpoints still require per-region setup, the consolidation of general access endpoints dramatically cuts down on manual maintenance toil and cloud costs.

These new capabilities are integrated directly into Databricks' context-based ingress controls. This unified policy engine allows administrators to write granular allow and deny rules based on user identity, network source, and destination. Account-level resources can be managed via a new account-policy, while existing workspace policies receive a dedicated private access section. Databricks recommends transitioning to these context-based controls over traditional IP access lists to maximize security flexibility.

The deployment is designed to be additive and non-disruptive, meaning existing workspace-specific URLs and legacy private access settings will continue to function in parallel. The new Inbound Private Link features are currently available in beta for customers on the AWS Enterprise tier and the Azure Premium tier. Meanwhile, the associated context-based ingress controls for public access have reached general availability.