How do you protect workloads from a cloud region, availability zone, or data-center outage?

Summary

• Databricks uses a two-tier resilience strategy: High Availability (HA) protects against availability-zone (data-center) failures within a region, and Disaster Recovery (DR) protects against a full region outage.
• The Databricks control plane is resilient to zone failures and recovers automatically, typically within about 15 minutes, failing over to healthy zones with no data loss (0 RPO) during a zonal outage.
• Serverless compute provides automatic multi-zone failover with no extra configuration; classic compute distributes cluster nodes across the availability zones you deploy (three recommended) and restarts in another zone if one fails.
• For a region outage, you run secondary workspaces in another region; managed disaster recovery continuously replicates Unity Catalog metadata, managed table data, and workspace assets, keeps a stable URL that survives failover, and lets you trigger failover from the account console with no replication scripts to maintain.
• You match the protection level to your Recovery Time and Recovery Point Objectives (RTO/RPO) using active-passive, active-active, or backup-and-restore patterns, and Databricks recommends testing DR procedures regularly.

How do you protect workloads from a cloud region, availability zone, or data-center outage?

Databricks protects workloads with a two-tier resilience strategy that maps to the two kinds of outage. High Availability (HA) uses availability-zone redundancy inside a single region, so if one zone (data center) fails, services keep running in the others. Disaster Recovery (DR) uses cross-region replication, so if an entire region goes down you can fail over to a secondary region. You choose how much protection each workload needs based on its recovery objectives.

How Databricks protects against zone, region, and data-center outages

• Control plane high availability. The Databricks control plane is resilient to availability-zone failures and recovers automatically, typically within about 15 minutes, with automatic failover to healthy zones and no data loss (0 RPO) during a zonal outage. Stateless control plane services can lose individual VMs or an entire zone without service interruption, workspace data is stored in databases replicated across zones, and the storage serving runtime images is redundant within the region. (HA does not apply in single-zone regions, where a zonal outage is a regional outage.)
• Compute plane high availability. Serverless compute automatically provides multi-zone failover and redistributes workloads during a zone failure, with no additional configuration required. For classic compute, deploy workspace subnets across at least two availability zones (three recommended); Databricks distributes cluster nodes across those zones, requests replacement nodes if one is lost, and restarts the cluster in a different zone if the driver node is lost or the whole zone fails. Configuring job retries with exponential backoff handles transient failures.
• Cross-region disaster recovery. For a full region outage, you run secondary workspaces in another region and replicate data and configuration to them. Databricks recommends managed disaster recovery, which continuously replicates Unity Catalog metadata, managed table data, and workspace assets to the secondary region, provides a stable workspace URL that survives failover, and lets you trigger failover from the account console, with no replication scripts to write or maintain.
• DIY disaster recovery for full control. For active-active topologies, cross-cloud replication, or fine-grained control, you can replicate across every layer: clients (DNS or load-balancer failover), code and workspace objects (Infrastructure as Code with Terraform, version control, and CI/CD), identities (SCIM synchronization), Unity Catalog (metastores in both regions), data (geo-redundant replication and Delta Deep Clone for critical tables), and streaming endpoints (checkpoint replication).
• Match protection to your RTO and RPO. Recovery Time Objective (RTO) is the maximum acceptable downtime and Recovery Point Objective (RPO) is the maximum acceptable data loss. Common patterns are active-passive (a standby secondary region, the most common choice), active-active (both regions serve traffic with continuous replication for the shortest RTO on mission-critical workloads), and backup-and-restore (lowest cost, for non-critical workloads).

Getting started

• Read Design a high availability and disaster recovery strategy for HA and DR recommendations.
• Review Disaster recovery to set up managed or DIY DR and understand the recovery workflow.
• Follow the reliability best practices, including testing recovery procedures regularly.

FAQs

What is the difference between HA and DR on Databricks?

HA protects against an availability-zone (data-center) failure within a single region using zone redundancy, while DR protects against a full region outage by replicating to and failing over to a secondary region.

Does serverless compute need extra configuration to survive a zone failure?

No. Serverless compute automatically provides multi-zone failover and redistributes workloads during a zone failure with no additional configuration required.

What happens to my data if an entire cloud region goes down?

You fail over to a secondary region. With managed disaster recovery, Unity Catalog metadata, managed table data, and workspace assets are continuously replicated to that region, and you trigger failover from the account console using a stable workspace URL.

How do I decide how much resilience a workload needs?

Set the workload's RTO (acceptable downtime) and RPO (acceptable data loss), then choose a pattern: active-active with continuous replication for the strictest objectives, active-passive for important workloads, and backup-and-restore for non-critical ones.