Azure Databricks workspace PEs stuck in pending after approval

Question

Azure Databricks workspace PEs stuck in pending after approval

YH 0

Trying to establish a PE from my subscription to Databricks workspace in another subscription.

The PE itself was created via the portal not CLI.

The PE request is seen in the other subscription but the approval which is done via CLI, is not coming through and the PE remains stuck in pending state.

Worth noting that a similar process for blob PE got approved successfully so this seems isolated to DBX workspaces.

What might be the issue? Also:

Is there a connection limit in Databricks workspaces?
Is there an issue using Portal creation and CLI approval?

0 comments

2 answers

Your answer

Answer 1

Jose Benjamin Solis Nolasco 12,281 Volunteer Moderator

Welcome to Microsoft Q&A,

Hello @YH I hope you are doing well,

To directly answer your two questions:

1. Is there an issue using Portal creation and CLI approval? No. Azure Resource Manager (ARM) is entirely agnostic to the management plane tool used. Creating the resource via the Azure Portal and approving it via Azure CLI (az network private-endpoint-connection approve) is a fully supported and standard workflow.

2. Is there a connection limit in Databricks workspaces? Yes. Unlike Azure Storage which allows hundreds of private endpoints, Azure Databricks has a hard limit of 5 private endpoints per workspace for front-end (inbound) connections (databricks_ui_api).

Why is it stuck in Pending? When you approve the PE via the CLI, you are interacting with the Azure Resource Manager. ARM then sends a sync request to the Databricks Control Plane to finalize the connection. If the connection remains stuck in "Pending", it means the sync between ARM and the Databricks backend failed. This typically happens for three reasons:

Quota Exhaustion: You have hit the 5 PE limit on the target workspace, so the Databricks Control Plane silently rejected the approval sync.

Incorrect Group ID: The PE was requested using the wrong sub-resource target (e.g., requesting browser_authentication when you meant databricks_ui_api), causing a validation failure on the Databricks side.

State Desynchronization: A transient API timeout occurred between Azure and the Databricks infrastructure during the CLI approval execution.

The Remediation: Because the state is now wedged between ARM and Databricks, you cannot force the approval through. You must delete the pending Private Endpoint connection from the Databricks workspace's Networking blade, verify you are under the 5 PE limit, and recreate the PE request.

Verify privateLinkServiceConnectionState.status = Approved in the PE JSON; copy the exact resource ID used in approval.

Compare with working Blob PE: export both PE JSONs and highlight differences (resource IDs, subresource, connectionState).

Check Databricks account PE rules on the Network connectivity configurations page for the workspace/account; confirm it’s not at quota.

Retry approval via portal UI in the Databricks subscription (to rule out CLI parameter mismatch).

If still Pending: gather the artifacts above and open an Azure Databricks support case (include PE JSON, CLI output, activity logs, timestamps, and a working Blob PE example).

https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-06-19T08:33:05.0866667+00:00
Hi @YH

The response provided by Jose is generally on the right track. However, for a Private Endpoint connection that remains in a Pending state after approval, I would focus on a few key areas first, as some items (such as connectivity ports and Private Link scale limits) are less likely to be the root cause.

Since creating the Private Endpoint through the Azure portal and approving it via Azure CLI is a supported workflow, this behavior is not expected.

I recommend verifying the following:

Ensure the Private Endpoint was created against the correct Azure Databricks sub-resource (for example, databricks_ui_api or browser_authentication).

Confirm that the correct Private Endpoint connection is being approved and validate the connection ID before running the approval command.

Check for any stale, failed, or previously created Private Endpoint connections associated with the Databricks workspace.

Verify that the identity performing the approval has the necessary permissions on the Databricks workspace resource.

Validate the Private DNS configuration, especially if Private Link is enabled (privatelink.azuredatabricks.net).

Azure Databricks does not have a commonly encountered Private Endpoint connection limit that would typically cause a newly created connection to remain in a Pending state.

If the issue persists, please share the following details to help narrow down the root cause:

Azure Databricks workspace region and SKU

Databricks sub-resource used while creating the Private Endpoint

Output of az network private-endpoint-connection list

Private Endpoint provisioning state

Any relevant Azure Activity Log errors

If all configurations appear correct and the connection still remains in Pending, this may require further investigation to validate backend synchronization between Azure Private Link and the Azure Databricks control plane.

Helpful documentation:

Azure Databricks Private Link overview: https://learn.microsoft.com/azure/databricks/security/network/front-end/front-end-private-connect

Configure private connectivity for Azure Databricks: https://learn.microsoft.com/azure/databricks/security/network/classic/private-link-standard

Troubleshoot Azure Databricks Private Link connectivity: https://learn.microsoft.com/azure/databricks/administration-guide/cloud-configurations/azure/private-link-simplified

I hope this helps. Please share the additional details above if you're still seeing the connection remain in Pending after approval.
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-06-19T09:19:04.3633333+00:00

Please let us know if you face any issues.
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-06-22T08:35:53.67+00:00

Hi @YH
Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
YH 0 Reputation points

2026-06-22T16:36:49.5+00:00

Thank you for all the comments. Unfortunately, none of the mentioned potential issues were applicable.

Today the owner of the workspace subscription indicated that the issue seems to have resolved on its own so we submitted a new connection request and it got approved.

I don't know what was the issue or how it got solved.
Jose Benjamin Solis Nolasco 12,281 Reputation points Volunteer Moderator

2026-06-22T18:24:20.3666667+00:00

@YH It was pending on the backend and must of the time took for a while to finish, but we are glad that you issue has been resolved.

Answer 2

For Azure Databricks workspaces, Private Link approval that stays in Pending even after being approved via CLI typically indicates an issue on the Databricks side of the Private Link configuration or a limit/quota condition, not a mismatch between portal-created endpoints and CLI-based approval.

From the available information:

There is no documented problem with creating the Private Endpoint in the Azure portal and approving it via CLI. Portal vs. CLI is just a management-plane choice; they operate on the same resource and API.
Databricks workspaces do have limits on Private Link–related endpoints. For performance‑intensive services, each Databricks account is limited to 5 private endpoints per region and 100 per account. Hitting this limit can prevent new connections from fully provisioning even if the Azure-side Private Endpoint shows as approved.
Private Link and public access are independent. Even after Private Link is configured, public access can still be enabled or disabled separately. This does not directly cause a Pending state, but misconfiguration on the Databricks account side (for example, exceeding endpoint limits) can.

Given the symptoms and the fact that a Blob Private Endpoint works but the Databricks workspace one does not, the most likely causes are:

Databricks account-level Private Link endpoint limits reached in that region.
Databricks account configuration for workspace Private Link not accepting additional connections.

Recommended actions:

Verify Databricks Private Link limits at the account level in that region (especially for performance‑intensive services). If close to or at the documented limits (5 per region, 100 per account), work with the Azure Databricks account team to request a quota increase.
Confirm that the target workspace is a Premium workspace in the same region as the Private Endpoint and that the Databricks account’s Private Link configuration is correctly set up for that workspace.
If limits are not exceeded and configuration appears correct, open a support case with Azure Databricks/Azure support, referencing the stuck Pending state and the account‑level Private Link limits.

Answers to the specific questions:

Is there a connection limit in Databricks workspaces?
Yes. For performance‑intensive services, each account is limited to 5 private endpoints per region and 100 per account.
Is there an issue using Portal creation and CLI approval?
No documented issue. Creating the Private Endpoint in the portal and approving via CLI is supported; the problem is more likely related to Databricks-side limits or configuration.

References:

Configure inbound Private Link for performance-intensive services