Databricks bolsters private access

Databricks is enhancing its Inbound Private Link capabilities to offer more granular control and simplified network management for enterprises. The update now extends private access to account-level resources like Genie One, the account console, and Governance Hub, alongside custom URLs. This move aims to meet the growing demand for secure, private connectivity as companies scale their data and AI operations on the Databricks Lakehouse Platform.

The core of this update is the ability to route user-to-Databricks traffic privately through an organization's own cloud network, bypassing the public internet. This is particularly critical for businesses handling sensitive data or operating under strict regulatory compliance. Previously, managing private links across numerous workspaces and regions could become complex. Databricks, which holds a StartupHub score of 82/100 and has verified financials including a $5 billion strategic financing in 2026 for a $190 billion valuation, is positioning this as a significant step for enterprise adoption.

Consolidating Access Points

A key improvement is the introduction of a single shared General Access endpoint. This consolidated endpoint, deployable in any region, can now serve all workspace and account-level UIs and APIs. This significantly reduces the manual effort and cost previously associated with setting up and maintaining individual endpoints per region or workspace. While teams with stringent network isolation needs can still opt for multiple endpoints, these are no longer restricted to serving resources within the same geographical region. For specific high-performance needs, service-direct endpoints and secure cluster connectivity relay endpoints will still require per-region configuration.

Context-Based Ingress Controls

These new Inbound Private Link features are built upon Databricks' context-based ingress controls. This system allows account administrators to define precise allow and deny rules based on the caller's identity, network source (public IP or registered endpoint), and the specific resource they are attempting to access. Policies for account-level resources can be managed through a new account-policy interface, while existing workspace policies receive a dedicated "private access" section. This unified policy engine consolidates management for both public and private ingress, offering a more sophisticated alternative to all-or-nothing IP access lists or older Private Access Settings.

Streamlining Custom and Stable URLs

Databricks Inbound Private Link now fully supports custom URLs, such as `acme.databricks.com`, and managed disaster recovery stable URLs. This means that the private network guarantees extend end-to-end, even when using branded or specialized stable URLs for resilience. For existing users of Inbound Private Link, this update is additive and non-disruptive. Non-custom, workspace-specific URLs will continue to function alongside custom URL access, ensuring a smooth transition.

Why This Matters for Enterprises

As enterprises increasingly rely on platforms like Databricks for mission-critical data and AI workloads, secure and manageable network access is paramount. The ability to extend private connectivity to account-level functions simplifies administration and strengthens the security posture. This is especially relevant given the growing adoption of AI agents and complex data pipelines, which often involve multiple services and accounts. By consolidating endpoints and enabling fine-grained access controls, Databricks is addressing key enterprise concerns around security, compliance, and operational efficiency. This move competes directly with offerings from major cloud providers and other data platforms like Snowflake (NASDAQ:SNOW), which also focus on secure data access.

The new capabilities are currently available in Beta on AWS and Azure for Enterprise and Premium tiers, respectively. Context-based ingress controls for public access are already generally available.