Allow Public Network Access - Disabled, I can still access the workspace from public internet

[rhlp]

Hi everyone,

We configured Private Link for an existing Azure Databricks workspace (Hybrid workspace):

• VNet injection and Secure Cluster Connectivity enabled
• databricks_ui_api private endpoint created
• publicNetworkAccess = Disabled
• requiredNsgRules = NoAzureDatabricksRules

Access through the private endpoint works, including browser login and clusters (tested it via a jumpbox)

However, the workspace is still accessible from the public internet. I confirmed that an authenticated API request to the public IP returns HTTP 200, even after waiting over an hour. Azure shows the workspace update as succeeded.

Has anyone experienced this? could this be a synchronization issue? How to resolve this?

[Gokul_Pillai1]

Hi @rhlp ,
This doesnt sound like the expected behaviour if the request is genuinely reaching the workspace API from the public internet.

A couple of things I would check first before coming into a conclusion 

Creating the databricks_ui_api private endpoint gives you a private path into the workspace, but it doesnt disable the public path by itself. That should be controlled by publicNetworkAccess = Disabled.
Also, NoAzureDatabricksRules is related to the required NSG rules, so it wouldnt affect whether the workspace API is publicly reachable.

I’d first confirm on the actual Azure Databricks workspace resource that properties.publicNetworkAccess is definitely showing as Disabled.

I’d also test from a completely external network, ideally with no corporate VPN, ExpressRoute, private DNS or proxy involved. Use the normal workspace hostname rather than testing against the raw public IP. Databricks uses shared front-end infrastructure, so getting an HTTP 200 from an IP alone doesn’t necessarily prove that the workspace itself is publicly accessible.

It’s also worth checking the actual response body/headers. For example, a front-end or authentication page may return 200 even though access to the workspace is still blocked. I’d test an authenticated workspace API such as /api/2.0/clusters/list and confirm you are actually getting data back from that workspace.

One more thing to do is, if browser access is intended to be fully private, make sure the browser_authentication private endpoint and Private DNS setup are configured correctly as well.

If publicNetworkAccess is definitely disabled, you are testing from a genuinely public network, DNS is resolving publicly, and an authenticated workspace API call is still successfully returning workspace data, then I’d raise a Databricks/Azure support case. At that point it could be a control-plane propagation or service-side configuration issue rather than expected Private Link behaviour.

Thank you so much !!