OpenSharing recipient firewall configuration for SecureConnect

Azure Databricks recipients use their existing OpenSharing setup to access shares from a provider who has enabled OpenSharing SecureConnect.

If your provider has enabled SecureConnect and you have an egress firewall, you must allow outbound connections to Azure Databricks IP addresses to access SecureConnect. Allowlist the IP addresses for the provider's cloud and region, regardless of the cloud you are on.

Important

Azure Databricks recipients on classic compute and open recipients must allow outbound connections to Azure Databricks IP addresses in their egress firewall. SecureConnect does not initiate inbound connections to the recipient's network.

Azure Databricks recipients on serverless compute do not need to configure their egress firewall to access SecureConnect. Azure Databricks routes serverless traffic to SecureConnect internally.

For an overview of SecureConnect and provider-side setup, see Share data behind a firewall with SecureConnect.

Allowlist Azure Databricks IPs in your egress firewall

Select the cloud your provider is on, then add the listed Azure Databricks IP addresses to your egress firewall's outbound allowlist for the provider's region.

AWS

For an AWS provider, allowlist the Azure Databricks IP addresses for "Default storage, OpenSharing SecureConnect, Zerobus Ingestion, and Lakebase (Autoscaling Beta)" corresponding to the provider's region.

See IP addresses and domains for Azure Databricks services and assets.

Azure

For an Azure provider, allowlist the Azure Databricks IP addresses for "Control Plane IPs, including default storage and webapp" corresponding to the provider's region.

See IP addresses and domains for Azure Databricks services and assets.

GCP

For a GCP provider, allowlist the Azure Databricks IP addresses for "Control Plane services, including default storage and webapp" for the provider's region. See IP addresses and domains for Azure Databricks services and assets.

Billing

Azure Databricks is expanding SecureConnect networking billing to include charges for recipients accessing shared data across regions or clouds. To understand how you might be billed, see Expanded networking billing for OpenSharing SecureConnect.

Limitations

The following limitations apply to Azure Databricks recipients accessing SecureConnect-enabled shares:

• mTLS is not enabled for recipients using classic compute.
• mTLS is not enabled for OIDC recipients.
• Serverless Azure Databricks recipients using a Databricks-to-Open credential in the same region as the provider are not supported.