Workspace got disabled

[SuMiT1]

Hi everyone,

I was creating a database linked service in ADF, but I got an error: "unauthorized network access to workspace." After that, I went to ADB networking and changed the public setting to "enable"; previously, it was disabled.

I think it is because of the NSG rule.

After that, my workspace got disabled, and the networking option is also not clickable.

Please help to revert the changes.

[szymon_dybczak]

Hi @SuMiT1 ,

Could you specify what do you mean by disabled? Change public networking setting to "enable" shouldn't cause any issue - and for sure it shouldn't disable your workspace. Maybe try to attach error message or screenshot of the error, so it will be easier for us to help you resolve this issue.

[SuMiT1]

Error - The workspace 'adb-new' is in a failed state and cannot be launched. Please review error details in the activity log tab and retry your operation

In activity log its showing auditpolicy action

[nayan_wylde]

If this is a new workspace is in a "Failed" or "Unupdatable" state, you may need to:
Redeploy the workspace.
Contact Microsoft Support for recovery assistance.

[szymon_dybczak]

Oh, in that case the easiest way would be to just redeploy it from scratch. It's really weird though that you encounter this issue. 

[nayan_wylde]

If your workspace is in private endpoints and hit that "unauthorized network access to workspace" error, check your NSG settings.
The NSG needs to allow traffic from the private endpoint to the Databricks workspace. Also, make sure the NSG configuration isn’t set to "No Azure Databricks Rules"—switch it to "All Rules" if needed. That change might help restore access and got things working again.

[SuMiT1]

@szymon_dybczak 

While redeploying i am getting one error

Conflictwithnetworkintentpolicy

Network security group attached to the databricks subnets does not comply with the network intent policy automatically created by azure databricks

[szymon_dybczak]

 Can you try to implement workaround suggest by following user:

https://github.com/Azure/azure-quickstart-templates/issues/6670#issuecomment-572479232

If above won't help then just delete all databricks related resource and deploy your workspace from scratch

[nayan_wylde]

I just wanted to check few things in the networking. Can you please confirm the following is properly set.

Make sure the subnet is delegated to Microsoft.Databricks/workspaces.
In Azure Portal:
Go to the subnet used by Databricks.
Under Delegation, ensure it's set to Microsoft.Databricks/workspaces.

[SuMiT1]

Hi @nayan_wylde 

Yes subnet delegation sets to Microsoft.Databricks/workspaces.

And in the network security group, I have one group, and I am unable to change it to none.

[nayan_wylde]

Also adding to @szymon_dybczak reply. You can refer to this github page.

https://github.com/databricks/terraform-databricks-sra/tree/main/azure

It has all the biceps and terraform templates. if you are deploying a secured workspace that have security constraints,.