topic Re: Creating Azure Databricks Workspace Without NAT Gateway in Administration & Architecture

Creating Azure Databricks Workspace Without NAT Gateway

ZD — Sun, 21 Jul 2024 16:23:12 GMT

Hello,

Recently, when I create a new Databricks workspace on Azure, it automatically create a NAT Gateway which incurs additional cost !

When creating the workspace, I don't choose secure cluster connectivity, so I'm expecting not to have a NAT Gateway created.

Why NAT gateway is created for my Databricks workspaces knowing that it was not the case a couple weeks ago ? and how to delete it, or deploy workspaces without it ?

If this is not possible, how to avoid this extra cost related to NAT Gateway ?

Re: Creating Azure Databricks Workspace Without NAT Gateway

szymon_dybczak — Sun, 21 Jul 2024 18:02:49 GMT

Hi @ZD ,

Do you create workspace with secure cluster connectivity? According to the documentation:

If you use secure cluster connectivity with the default VNet that Azure Databricks creates, Azure Databricks automatically creates a NAT gateway for outbound traffic from your workspace’s subnets to the Azure backbone and public network. The NAT gateway is created within the managed resource group managed by Azure Databricks. You cannot modify this resource group or any resources provisioned within it.

The automatically-created NAT gateway incurs additional cost.

If you would like to avoid automatic creation of NAT gateway in secure cluster connectivity, you should perform VNET injection. Read below documentation entry for additional details:

Secure cluster connectivity - Azure Databricks | Microsoft Learn

Secure cluster connectivity - Azure Databricks | Microsoft Learn

EDIT: Sorry, didn't notice that you've mentioned you don't use secure cluster connectivity. So that's bit weird. Maybe at your organization there is some kind of azure policy that disables IP (so it enables implicitly SCC) ?

I've also created new workspace with the same configuration as yours and I don't have NAT gateway in DB manged RG

Re: Creating Azure Databricks Workspace Without NAT Gateway

ZD — Sun, 21 Jul 2024 18:26:12 GMT

Thank you @szymon_dybczak for your reply.

Not only in my organization subscription, but also I've created a new Azure Free Tier account, and it automatically creates NAT Gateway for Databricks workspaces.

Re: Creating Azure Databricks Workspace Without NAT Gateway

szymon_dybczak — Sun, 21 Jul 2024 21:10:24 GMT

Really weird, could you check how's your arm template looks like in rg deployments? To make sure that in your case there is no scc deployment?
I've created workspace with the same configuration and same region as your and my input for arm template looks like below. Inside managed rg I don't have NAT Gateway.

I've also created another workspace, but this time with SCC enabled. And now I've got NAT Gateway, just as is stated in documentation.

Re: Creating Azure Databricks Workspace Without NAT Gateway

ZD — Sun, 21 Jul 2024 23:53:27 GMT

Indeed weird! It seems that the issue has been resolved but I really don't understand what was going on. It seems it's an interface issue in Azure portal. For now, I'll go a head and accept your solution as it helps to better debug the issue. I will update the discussion in case I encountered the issue again. Thank you @szymon_dybczak for your help

Re: Creating Azure Databricks Workspace Without NAT Gateway

DInu1 — Fri, 13 Jun 2025 17:44:50 GMT

I Have a Azure Account and i am using Databricks Over there until Now NAT Gateway was not created , Yesterday NAT Gateway was created and it is consuming More Cost

Can Anyone Help me to remove NAT Gateway and use data bricks in azure

Re: Creating Azure Databricks Workspace Without NAT Gateway

OmarSEKkOUTI — Thu, 19 Jun 2025 19:58:16 GMT

Hey,

Did you find any solution , I have the same issue .

Re: Creating Azure Databricks Workspace Without NAT Gateway

Khaja_Zaffer — Sat, 05 Jul 2025 14:27:06 GMT

Hello @OmarSEKkOUTI

The solution is simple: try to create a vnet-injected workspace.

like here: Azure Vnet injection

This is to avoid creating a NAT gateway.

Also, Databricks says:

If you enable secure cluster connectivity on your workspace that uses VNet injection, Databricks recommends that your workspace has a stable egress public IP.

Re: Creating Azure Databricks Workspace Without NAT Gateway

ZD — Wed, 23 Jul 2025 08:44:48 GMT

Make sure to disable the following option when creating your workspace, as it has recently become enabled by default.

Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP)