Hi @ZD ,

Do you create workspace with secure cluster connectivity? According to the documentation: 

If you use secure cluster connectivity with the default VNet that Azure Databricks creates, Azure Databricks automatically creates a NAT gateway for outbound traffic from your workspace’s subnets to the Azure backbone and public network. The NAT gateway is created within the managed resource group managed by Azure Databricks. You cannot modify this resource group or any resources provisioned within it.

The automatically-created NAT gateway incurs additional cost.

If you would like to avoid automatic creation of NAT gateway in secure cluster connectivity, you should perform VNET injection. Read below documentation entry for additional details:

Secure cluster connectivity - Azure Databricks | Microsoft Learn

Secure cluster connectivity - Azure Databricks | Microsoft Learn

EDIT: Sorry, didn't notice that you've mentioned you don't use secure cluster connectivity. So that's bit weird. Maybe at your organization there is some kind of azure policy that disables IP (so it enables implicitly SCC) ?

I've also created new workspace with the same configuration as yours and I don't have NAT gateway in DB manged RG