Click Create resource group to create a resource group for your workspace.In the Azure portal, go to the resource groups blade.To compare this to the Private Link simplified deployment, see Network flow and network object diagrams Step 1: Create resource groups The following diagram shows the network flow in a typical implementation of the Private Link standard deployment: See Step 4: Create a private endpoint to support SSO (required for UI access) for details. Databricks strongly recommends creating a workspace called a private web auth workspace for each region to host the web auth private network settings. One of these connections is shared for all workspaces in the region that share the same private DNS zone.

A special type of private connection with sub-resource type browser_authentication hosts a private connection from the transit VNet that allows Azure Active Directory to redirect users after login to the correct control plane instance. To support private front-end connections, special configuration is required to support the single sign-on (SSO) login callbacks to the Azure Databricks web application, also known as web authentication. By contrast, the serverless data plane that supports serverless SQL warehouses (Public Preview) runs in the Azure subscription of Azure Databricks. In the context of this article, data plane refers to the Classic data plane in your Azure subscription. This article mentions the term data plane, which is the compute layer of the Azure Databricks platform.

Controlplane rules confidence