How can Network Security perimeter be associated with Databricks Managed workspace storage account?

Question

We have received an email from Microsoft to switch to network security perimeter where we have allow-listed Azure Databricks serverless subnet IDs in any Azure storage firewalls. Basically our databricks managed workspace storage account which starts with db are allow listed with Azure Databricks serverless subnet IDs and when we are trying to associated NSP to them then it gives us an error **unexpected status **403 (403 Forbidden) with error: LinkedAuthorizationFailed.

Since we don't have access to perform this operation on databricks managed workspace storage account then how can we associate NSP with them so that they can function properly with serverless compute as nothing has been mentioned about it in the public documentation network security perimeter ?

Answer 1

Hi Sahil Chaudhry

The behavior you’re seeing is expected for Databricks managed workspace storage accounts.

The storage accounts that start with db* are created and managed by Azure Databricks in a Microsoft-managed resource group. Because of this:

• Customers don’t have full RBAC permissions on those resources
• Certain operations (like associating a Network Security Perimeter) aren’t allowed
• Attempts to modify networking/security settings can return LinkedAuthorizationFailed (403)

So the 403 isn’t a misconfiguration - it’s happening because the resource is service-managed.

What this means for NSP

At this time, Network Security Perimeter association isn’t supported directly on Databricks-managed storage accounts. Those resources are governed by the Databricks service itself, not by customer-applied network perimeters.

Recommended approach

• Apply NSP to customer-managed storage accounts that your workloads access
• Follow Databricks guidance for serverless connectivity and firewall allow-listing
• If NSP enforcement is a hard requirement, raise a support ticket with Microsoft to confirm current supportability or roadmap, since this is service-level behavior

Hope this helps clarify why you’re hitting that error.