Disable Public Network Access on Databricks Managed Storage Account - Deny Assignment

MyProfile — Thu, 16 Apr 2026 17:52:13 GMT

Issue Description:
I am attempting to disable public network access on the Azure Databricks managed storage account. However, I am encountering the following error:

Failed to save resource settings — access is denied due to a deny assignment created by Azure Databricks on the managed resource group.

Although the client has Microsoft.Storage/storageAccounts/write permission, the operation is blocked by a system deny assignment associated with the Databricks workspace.

The goal is to block all public access to the databricks managed storage account while ensuring secure connectivity for:

-- Control Plane → Storage Account
-- Compute Plane (Databricks clusters) → Storage Account
-- External Sources → Storage Account (via Private Endpoint or other secure mechanisms only)

Context / Query:
Based on the Microsoft documentation on Databricks storage firewall support, it mentions:

"Enable firewall support for your workspace storage account - Azure Databricks | Microsoft Learn"

“Contact your Azure Databricks account team to update the managed resource group configuration before proceeding.”

I would like to understand:

1) Whether the firewall support approach allows disabling public network access for the managed storage account
2). If not directly, what is the recommended architecture/configuration to:
a). Restrict public access
b). Ensure Control Plane and Compute Plane connectivity
c). Enable secure external access (Private Endpoint / VNet-based access)

Ask:
--> Whether disabling public access on the managed storage account is supported in this setup
--> If yes, the exact steps/configuration required
--> If not, the alternative secure approach to meet the above requirements

Re: Disable Public Network Access on Databricks Managed Storage Account - Deny Assignment

Sumit_7 — Fri, 17 Apr 2026 06:19:28 GMT

@MyProfile This would be helpful, check once - https://learn.microsoft.com/en-us/answers/questions/1707749/managed-storage-accounts-compliance

topic Disable Public Network Access on Databricks Managed Storage Account - Deny Assignment in Data Engineering

Disable Public Network Access on Databricks Managed Storage Account - Deny Assignment

Re: Disable Public Network Access on Databricks Managed Storage Account - Deny Assignment