IP addresses and domains for Azure Databricks services and assets

This article lists IP addresses and domains for Azure Databricks services and assets.

You may need this information if your Azure Databricks workspace is deployed to your own virtual network (VNet) and you use custom routes, also known as user-defined routes (UDR), to manage network traffic using a virtual appliance or firewall.

See User-defined route settings for Azure Databricks.

Databricks strongly recommends that you use the Azure Databricks service tag instead of specific IP addresses. Azure service tags represent a group of IP address prefixes from a given Azure service. The Azure Databricks service tag represents IP addresses for the required outbound connections to the Azure Databricks control plane, the secure cluster connectivity (SCC), and the Azure Databricks web application. Azure Databricks manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change. This helps to prevent service outages due to IP changes and removes the need to periodically look up these IPs and update them.

Azure Databricks control plane addresses

The IP addresses you use to route network traffic depend on whether or not your Azure Databricks workspace uses secure cluster connectivity (SCC):

• Secure cluster connectivity enabled: use the SCC relay value and the Control Plane IPs, including webapp values for the workspace region. These values are in the Inbound to Azure Databricks control plane section.
• Secure cluster connectivity disabled : use the Control Plane IPs, including webapp values for the workspace region from the Inbound to Azure Databricks control plane section and the Control Plane NAT values for the workspace region in the Outbound from Azure Databricks control plane section.

Most regions have multiple IP address ranges for the control plane IPs, Webapp, and NAT. This is because those regions contain more infrastructure services than others. Your workspace will be assigned to infrastructure services at one IP address for the control plane NAT and one for the Webapp during workspace creation. Your workspace will not be accessible by the infrastructure services at the other IP addresses, because data and secrets are not shared between infrastructure services within a region. There are therefore no security issues with having multiple IP addresses specified in your network security groups.

Inbound to Azure Databricks control plane

Outbound from Azure Databricks control plane

These values are used only if secure cluster connectivity is disabled.

DBFS root storage IP address

To get IP addresses for DBFS root storage:

1. Go to the workspace instance in Azure portal.
2. Click the workspace's managed resource group name.
3. In the list of resources, find a storage account with the name in the format dbstorage************ and copy it.
4. Get the endpoint domains, using the storage account name that you copied:
   • Domain <storage-account-name>.blob.core.chinacloudapi.cn. For example, dbstorage9875b57ac95c.blob.core.chinacloudapi.cn.
   • Domain <storage-account-name>.dfs.core.chinacloudapi.cn. For example, dbstorage9875b57ac95c.dfs.core.chinacloudapi.cn.
5. Look up the IP addresses for these domain names.
6. Create two UDRs to these IP addresses so that the UDRs route the traffic to the Azure Storage service.

Metastore, artifact Blob storage, system tables storage, log Blob storage, and Event Hubs endpoint IP addresses

To get the workspace-level Hive metastore, artifact Blob storage, system tables storage, log Blob storage, and Event Hubs IP addresses, you must use their domain names, provided in the following table, to look up the IP addresses.