How quickly can we fail over to a backup environment, and how do we fail back safely?

Summary

• Databricks provides layered resilience: automatic zone failover within a region and cross-region failover to a secondary (backup) environment for a full region outage.
• For an availability-zone failure, the control plane fails over automatically to healthy zones, typically within a 15-minute RTO and with an RPO of 0 (no committed data lost).
• For a region outage, Databricks Managed Disaster Recovery lets you trigger a cross-region failover that completes in minutes, points a stable workspace URL at the new region, and resumes job schedules there.
• Failing back is the same controlled operation in reverse: you fail over again with the original region as the target, which reverses replication and returns traffic once that region is healthy.
• You set the RTO and RPO each workload needs, and Databricks recommends testing failover regularly (for example, quarterly) so real recovery matches your targets.

How quickly can we fail over to a backup environment, and how do we fail back safely?

How quickly you can fail over depends on the type of outage and the recovery targets you set. Databricks provides resilience in layers: within a region, the control plane fails over automatically between availability zones; for a full region outage, you fail over to a secondary (backup) region. Failing back is the same controlled failover operation run in reverse. You decide how fast recovery must be by setting a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each workload. See Design a high availability and disaster recovery strategy.

How fast failover is and how failback works

• Automatic zone failover, ~15-minute RTO, 0 RPO. In a multi-zone region, the control plane is resilient to an availability-zone failure and recovers automatically, typically within a 15-minute RTO and with an RPO of 0, so no committed data is lost. Serverless compute fails over across zones with no additional configuration. See intra-region high availability guarantees.
• Cross-region failover in minutes. For a full region outage, Databricks Managed Disaster Recovery continuously replicates Unity Catalog metadata, managed table data, and workspace assets to a secondary region. Triggering a failover completes in minutes: Databricks points the stable workspace URL at the new primary region, reverses the direction of replication, and pauses job schedules in the former region so you can resume the ones you need in the new region.
• A stable URL means clients keep working. The stable workspace URL always points to the current primary region, so clients connected through it continue working after failover without reconfiguration.
• Failing back safely. To return to the original region once it is healthy, you repeat the failover with the original region as the target. Databricks reverses replication again so the two environments resync; you then validate the restored region and resume production there. A safe failback means stopping writes in the secondary, letting replication catch up, and confirming the restored environment before you cut back over.
• Mind the RPO on an unplanned failover. In an unplanned failover, data written after the last replication point may not have reached the secondary region, so confirm that any potential loss stays within your RPO target.

Getting started

• Set an RTO and RPO for each workload, then read Design a high availability and disaster recovery strategy.
• Set up cross-region recovery with Databricks Managed Disaster Recovery and review the typical recovery workflow.
• Test failover and failback regularly (for example, quarterly) so your team knows the procedure before a real outage; see reliability best practices.
• Read how Databricks Managed Disaster Recovery helps Capital One achieve lakehouse resilience.

FAQs

How quickly can Databricks fail over after an availability-zone outage?

In a multi-zone region the control plane fails over automatically to healthy zones, typically within a 15-minute RTO and with an RPO of 0, and serverless compute fails over across zones with no extra configuration.

How long does a cross-region failover take?

With Databricks Managed Disaster Recovery, triggering a failover to the secondary region completes in minutes; the stable workspace URL is pointed at the new region and job schedules can be resumed there.

How do we fail back to the original region?

Once the original region is healthy, you run the failover again with it as the target. Databricks reverses replication so the environments resync; you then validate the region and resume production. Stopping writes in the secondary and letting replication catch up first keeps failback safe.

Will we lose data during failover?

Committed data is protected with an RPO of 0 during a zonal failover. In an unplanned cross-region failover, data written after the last replication point may be lost, so set and verify an RPO that matches each workload's tolerance.