Customer-Facing Collateral

12.1 · Sizing & architecture decision guide

Two deliverables: a CIDR/subnet worksheet (size once for peak — subnet CIDR is immutable) and a topology tree (Managed → Hardened → Isolated). Switch the diagram between the sized VNet and the three reference architectures; click any box for the "what + why."

Subnet size → node ceiling (usable = 2^(32−n) − 5)

The three reference architectures

SCC + VNet injection are in all three — the baseline, not an upgrade.

Illustrative config — sized, delegated subnets (immutable)

Terraform (azurerm) — the CIDRs that set the node ceiling. Full VNet/NSG/NAT module is in the M2/M3 hands-on artifacts.

resource "azurerm_virtual_network" "adb" {
  address_space = ["10.50.0.0/16"]          # /16: room for big subnets + a PL subnet
}
resource "azurerm_subnet" "container" {     # "private subnet" — MUST equal host size
  address_prefixes = ["10.50.1.0/24"]       # /24 = 251 usable -> ~251 node ceiling
  delegation { name = "databricks-del"
    service_delegation { name = "Microsoft.Databricks/workspaces" } }   # required
}
# 10.50.2.0/27 left free for the back-end Private Link endpoint subnet.

Portal: Virtual networks → + Create → set address space → + Add subnet ×2 (equal, non-overlapping) → Azure Databricks → Networking → Deploy to your VNet = Yes. ⚠️ CIDR can't change after Create.

12.2 · Customer security & networking overview

The "is it secure?" briefing — six pillars, each a named, verifiable control. Switch the diagram between the six pillars view (where each pillar attaches) and the default vs opt-in view; click a box for the "what + why."

Default vs opt-in

Illustrative config — prove the audit trail live

SQL — the query an FDE runs in front of the security team. Nothing lands better than showing the log.

SELECT event_time, user_identity.email AS who, service_name, action_name,
       source_ip_address, response.status_code
FROM system.access.audit
WHERE event_date >= current_date() - INTERVAL 7 DAYS
  AND response.status_code >= 400          -- 4xx/5xx = denied or errored
ORDER BY event_time DESC LIMIT 100;

12.3 · Deployment & hardening checklist

The pre-flight checklist — 13 items, each with why · how · verify. The whole list is the three-path scaffold with one control bolted onto each hop. Switch the diagram between the three connectivity paths to see which checklist items lock each; click a box for the proof.

The 13 items (why / verify)

Illustrative config — the SCC + VNet-injection workspace

resource "azurerm_databricks_workspace" "this" {
  sku = "premium"                            # Premium -> PL, CMK, IP ACLs, CSP
  custom_parameters {
    no_public_ip       = true                # SCC / NPIP (item 2)
    virtual_network_id = azurerm_virtual_network.adb.id   # VNet injection (item 1)
  }
  public_network_access_enabled = false      # item 7 (with front+back-end PL in place)
}

IP ACLs: databricks workspace-conf set-status --json '{"enableIpAccessLists":"true"}'. NCC: Account Console → Cloud resources → Network Connectivity Configurations.

Decision guide — what an architect recommends

Customer Q&A — what the security team actually asks

Common asks & the answer

What breaks in the field — and the FIRST check

Three questions before recommending an architecture

1. Is there a named regulatory mandate for no public-IP hop / data exfiltration protection — or is backbone-private enough?
2. Do they need to restrict who connects and control serverless egress, or just secure defaults?
3. What's the five-year peak node count (sizing), and are they on Premium (Private Link / CMK / IP ACLs / CSP are Premium-only)?