Inbound Private Link now supports account-level Genie One, the account console, and custom URLs
Databricks has expanded Inbound Private Link to support account-level resources, custom URLs, and disaster recovery endpoints in Beta on AWS and Azure, reducing endpoint management overhead.
Databricks now supports Inbound Private Link for account-level resources in Beta on AWS and Azure, including Genie One, the account console, Governance Hub, and account-level APIs. This allows customers to route traffic privately through their cloud networks for these resources, maintaining existing network guarantees. Previously limited to workspace-level access, the expansion addresses scaling needs for enterprises managing multiple workspaces and regions.
The update introduces support for custom URLs and managed disaster recovery stable URLs, enabling end-to-end private routing for resources like acme.databricks.com and acme.databricks.com/?c=stable-ws-id. Customers can now use a single shared General Access endpoint in any region for all UI and API resources, eliminating the need to create separate endpoints per region or workspace. This reduces manual maintenance and operational costs, though service-direct and SCC relay endpoints still require per-region configuration.
New Inbound Private Link capabilities integrate with context-based ingress controls, allowing account admins to define fine-grained policies based on identity, network source, and destination. Policies for account-level resources can be set in the new account-policy, while workspace policies include a dedicated section for private access configuration. This unified policy engine supports both public and private ingress, replacing all-or-nothing IP access lists or Private Access Settings for enhanced flexibility.
The expanded Inbound Private Link features are available now in Beta on AWS Enterprise tier and Azure Premium tier, while context-based ingress controls for public access are Generally Available. Existing Inbound Private Link users can adopt these changes without disruption, as non-custom workspace URLs and legacy settings continue to function in parallel. Customers are encouraged to migrate to context-based ingress for optimal platform benefits.