Can serverless workloads access private networks or internal systems?

Summary

• Yes. Databricks serverless workloads can reach private networks and internal systems through secure, account-managed connectivity, kept off the public internet.
• The Network Connectivity Configuration (NCC) is the account-level construct that manages serverless network connectivity and can be attached to many workspaces in a region.
• Private endpoints (Private Link) route serverless traffic to your resources — storage, databases, and internal services — over private connectivity rather than the public internet.
• For resources without private endpoints, NCC provides stable egress IPs you can allowlist on storage firewalls and databases, and network policies restrict serverless outbound traffic.
• See serverless best practices for networking and connectivity.

Can serverless workloads access private networks or internal systems?

Yes. Databricks serverless compute can securely connect to private networks and internal systems — including cloud storage, databases, and internal services — through connectivity that is managed at the account level and kept off the public internet. Access is centrally configured and governed rather than opened up per workload.

How serverless connects to private networks on Databricks

• Network Connectivity Configuration (NCC). The NCC is an account-level, regional construct that centrally manages serverless network connectivity. Account admins create it in the account console and attach it to workspaces in the same region.
• Private endpoints (Private Link). Configure private endpoint rules in the NCC to route serverless traffic to your resources — cloud storage, databases, and internal services — over private connectivity rather than the public internet. The endpoint is dedicated to your account and reachable only from authorized workspaces.
• Stable egress IPs and firewall allowlisting. For resources where private endpoints are not available, NCC provides stable egress IPs (and equivalent stable subnets or project identifiers) that you can allowlist on storage firewalls and databases.
• Egress control with network policies. Serverless outbound traffic is governed by network policies that restrict and monitor destinations, defined by IP range or fully qualified domain name.
• Managed ingestion to private sources. Lakeflow Connect connects to enterprise applications and databases so you can bring data from internal systems into Databricks through managed pipelines.

Getting started

• Read serverless networking and connectivity best practices for how to design serverless access to private resources.
• Review Private Link concepts and design serverless connectivity (NCC) for the account-level setup.
• See hardened connectivity for locking down serverless egress with network policies.

FAQs

How do serverless workloads reach a private database?

You configure a private endpoint rule in the Network Connectivity Configuration so serverless compute connects to the database over private connectivity, or you allowlist the NCC's stable egress IPs on the database firewall.

Does serverless traffic go over the public internet?

It does not have to. With private endpoints configured in the NCC, serverless traffic to your resources travels over private connectivity, and network policies let you restrict outbound destinations.

Can I control which destinations serverless compute can reach?

Yes. Network policies govern serverless egress, letting you allow only specific destinations by IP range or fully qualified domain name.