Databricks: Insufficient Permission to Add Public IP Address and NAT Gateway

Question

Databricks: Insufficient Permission to Add Public IP Address and NAT Gateway

DS (CTF) 20

Hello everyone,

I have a Azure Databricks resource group that pre-dates the configuration of a NAT Gateway and Standard Public IP address by default.

I have tried to create a Public IP/Nat Gateway in my databricks resource group, but DENY permissions are set by the system which do not allow any changes to the databricks resource group.

How do I get access to do this or do I need to contact Azure support? I received an e-mail that they are retiring default outbound access by September 30, 2025.

Can someone please point me in the right direction?

phemanth 15,765 Reputation points Microsoft External Staff Moderator

2025-03-19T04:39:55.8266667+00:00

@DS (CTF) Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

0 additional answers

Your answer

phemanth 15,765 Reputation points Microsoft External Staff Moderator

2025-03-19T04:39:55.8266667+00:00

@DS (CTF) Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Deepanshu katara 16,720 MVP Moderator

Hello , Welcome to MS Q&A

Your issue is due to Azure Databricks-managed resource groups being locked by the system, preventing users from making direct modifications. This is why you are encountering DENY permissions when trying to create a Public IP/NAT Gateway within the Databricks resource group.

✅ Recommended Approach: Attach NAT Gateway to a Custom-Managed V-Net

Check if Your Databricks Workspace Uses a Managed or Custom VNet
- If your workspace was deployed without a custom VNet, Azure automatically manages the networking, and you cannot modify the Databricks resource group.
- You need to recreate the workspace using a VNet-injected (custom VNet) deployment.
Deploy Databricks with a Custom VNet
- Create a new Databricks workspace with the VNet injection option.
- In this setup, Databricks deploys its cluster nodes into a custom V-Net that you control.
- Attach a NAT Gateway and Standard Public IP to the custom V-Net’s outbound subnet .
Move Workloads to the New Workspace
- Since you cannot modify the existing Databricks-managed resource group, you must migrate your notebooks, clusters, and jobs to the new Databricks workspace.

Please let me know if any further ques

Kindly accept answer if it helps

Thanks
Deepanshu

Deepanshu katara 16,720 Reputation points MVP Moderator

2025-03-17T06:34:28.29+00:00

What is Managed Resource Group?

This resource group holds all the resources that are required by the managed application. For example, this resource group contains the virtual machines, storage accounts, and virtual networks for the solution. The customer has limited access to this resource group because the customer doesn't manage the individual resources for the managed application.

Is it possible to delete/Modify the Managed Resource Group?

When we create a Azure Databricks workspace, by design it will automatically create Databricks Managed resource Group. The managed resource group must exist as this is where your cluster(s) will be created. To ensure that nothing breaks them, they are placed in a separate resource group (managed resource group) that has a super lock on it so you cannot modify anything in it.
phemanth 15,765 Reputation points Microsoft External Staff Moderator

2025-03-20T05:46:42.46+00:00

@DS (CTF) Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
DS (CTF) 20 Reputation points

2025-03-23T17:14:47.7033333+00:00

For everyone out there; I have accepted the answer and have migrated to a new dbw.

Share via

Databricks: Insufficient Permission to Add Public IP Address and NAT Gateway

0 additional answers

Your answer