@Yelf, this is how private link works. Once you enable private link, your per-workspace URL will resolve to privatelink.workspace-url.azuredatabricks.net,

If you are on your private network, you should have a private DNS zone setup that resolves this domainname to a private IP. Otherwise (if you use public DNS), it will resolve to the region-specific URL (which, in turn, will resolve to a public IP).

So:

1. There will still always be a CNAME (and public IP) resolution for your per-workspace URL. If you disable public access, it will just block all traffic on this (public) endpoint.
2. If you don't get resolved to a private IP on your private network, make sure to
   a) check if the per-region URL resolves to privatelink-url (if not, the private link is misconfigured or not approved)
   b) check your private DNS zone for an A record mapping this privatelink-hostname to your private IP