VNet injection
VNet injection is a Databricks compute / bi capability, introduced January 2019.
Deploying an Azure Databricks workspace's classic compute plane into an Azure virtual network you own, for network customization, private connectivity to Azure services and on-premises sources, custom DNS, and traffic inspection.
- The "public subnet" is a nickname, not a promise: the host subnet is sometimes called the public subnet, yet with secure cluster connectivity both of the workspace subnets use only private IPs.
- Choose your subnet sizes like a tattoo - the docs state flatly that subnet CIDR ranges cannot be changed after deployment.
- It took seven years to get a way in after the fact - only in March 2026 did migrating an existing workspace from a Databricks-managed VNet into your own VNet become generally available.
Limitations: The VNet must be in the same region and subscription as the workspace, with an address space between /16 and /24, and two dedicated subnets (container and host) of at least /26 recommended. Subnets cannot be shared across workspaces or host other Azure resources, and subnet CIDR ranges cannot be changed after deployment. After March 31, 2026, new VNets require an explicit outbound connectivity method (Databricks recommends a NAT gateway).
Open in REbricked →- Category
- Compute / BI
- Also known as
- Bring Your Own VNET, BYO VNet, VNet-injected workspace, Deploy Azure Databricks in your Azure virtual network
- Verified
- 2026-09-27