01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
az account list
--query '[*].id'
02 The command output should return the requested subscription identifiers (IDs):
[
"abcdabcd-1234-abcd-1234-abcdabcdabcd",
"abcd1234-abcd-1234-abcd-abcd1234abcd"
]
03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
04 Run databricks workspace update command (OSX/Linux/UNIX) to disable public network access to the selected Azure Databricks workspace. Because your workspace data plane does not need Network Security Group rules to connect to the Azure Databricks control plane anymore, NSG rules are not necessary. Set the --required-nsg-rules parameter to NoAzureDatabricksRules to disable the associated NSG rules:
az databricks workspace update
--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Databricks/workspaces/cc-project9-data-workspace"
--public-network-access Disabled
--required-nsg-rules NoAzureDatabricksRules
05 The command output should return the configuration information available for the modified Databricks workspace:
{
"authorizations": [
{
"principalId": "abcd1234-abcd-1234-abcd-abcd1234abcd",
"roleDefinitionId": "abcd1234-abcd-1234-abcd-abcd1234abcd"
}
],
"createdBy": {
"applicationId": "abcd1234-abcd-1234-abcd-abcd1234abcd",
"oid": "abcd1234-abcd-1234-abcd-abcd1234abcd",
"puid": "ABCDABCDABCDABCD"
},
"createdDateTime": "2025-10-09T08:51:19.9701424Z",
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Databricks/workspaces/cc-project9-data-workspace",
"isUcEnabled": false,
"location": "westeurope",
"managedResourceGroupId": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/databricks-rg-cc-project9-data-workspace-abcdabcdabcd",
"name": "cc-project9-data-workspace",
"parameters": {
"customPrivateSubnetName": {
"type": "String",
"value": "cc-project9-vnet-subnet-002"
},
"customPublicSubnetName": {
"type": "String",
"value": "cc-project9-vnet-subnet-001"
},
"customVirtualNetworkId": {
"type": "String",
"value": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/virtualNetworks/cc-project9-vnet"
},
"enableNoPublicIp": {
"type": "Bool",
"value": true
},
"prepareEncryption": {
"type": "Bool",
"value": false
},
"requireInfrastructureEncryption": {
"type": "Bool",
"value": false
},
"resourceTags": {
"type": "Object",
"value": {
"application": "databricks",
"databricks-environment": "true"
}
},
"storageAccountName": {
"type": "String",
"value": "abcdabcdabcdabcdabcdabcd"
},
"storageAccountSkuName": {
"type": "String",
"value": "Standard_GRS"
}
},
"provisioningState": "Succeeded",
"resourceGroup": "cloud-shell-storage-westeurope",
"sku": {
"name": "premium"
},
"tags": {},
"type": "Microsoft.Databricks/workspaces",
"workspaceId": "123456789012",
"workspaceUrl": "adb-123456789012.5.azuredatabricks.net"
}
06 (Optional) Once the new network configuration is applied, no public networks can access your Databricks workspace. To allow secure access via private endpoints, follow the steps outlined on this page.
07 Repeat steps no. 4 - 6 for each Azure Databricks workspace that you want to configure, available in the selected subscription.
08 Repeat steps no. 3 – 7 for each Azure subscription created in your Microsoft Azure cloud account.
Security