Azure Databricks workspace PEs stuck in pending after approval

YH 0 Reputation points
2026-06-17T23:17:09.4+00:00

Trying to establish a PE from my subscription to Databricks workspace in another subscription.

The PE itself was created via the portal not CLI.

The PE request is seen in the other subscription but the approval which is done via CLI, is not coming through and the PE remains stuck in pending state.

Worth noting that a similar process for blob PE got approved successfully so this seems isolated to DBX workspaces.

What might be the issue? Also:

  • Is there a connection limit in Databricks workspaces?
  • Is there an issue using Portal creation and CLI approval?
Azure Private Link
Azure Private Link

An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.

0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-06-17T23:17:19.19+00:00

    For Azure Databricks workspaces, Private Link approval that stays in Pending even after being approved via CLI typically indicates an issue on the Databricks side of the Private Link configuration or a limit/quota condition, not a mismatch between portal-created endpoints and CLI-based approval.

    From the available information:

    1. There is no documented problem with creating the Private Endpoint in the Azure portal and approving it via CLI. Portal vs. CLI is just a management-plane choice; they operate on the same resource and API.
    2. Databricks workspaces do have limits on Private Link–related endpoints. For performance‑intensive services, each Databricks account is limited to 5 private endpoints per region and 100 per account. Hitting this limit can prevent new connections from fully provisioning even if the Azure-side Private Endpoint shows as approved.
    3. Private Link and public access are independent. Even after Private Link is configured, public access can still be enabled or disabled separately. This does not directly cause a Pending state, but misconfiguration on the Databricks account side (for example, exceeding endpoint limits) can.

    Given the symptoms and the fact that a Blob Private Endpoint works but the Databricks workspace one does not, the most likely causes are:

    • Databricks account-level Private Link endpoint limits reached in that region.
    • Databricks account configuration for workspace Private Link not accepting additional connections.

    Recommended actions:

    1. Verify Databricks Private Link limits at the account level in that region (especially for performance‑intensive services). If close to or at the documented limits (5 per region, 100 per account), work with the Azure Databricks account team to request a quota increase.
    2. Confirm that the target workspace is a Premium workspace in the same region as the Private Endpoint and that the Databricks account’s Private Link configuration is correctly set up for that workspace.
    3. If limits are not exceeded and configuration appears correct, open a support case with Azure Databricks/Azure support, referencing the stuck Pending state and the account‑level Private Link limits.

    Answers to the specific questions:

    • Is there a connection limit in Databricks workspaces?
      Yes. For performance‑intensive services, each account is limited to 5 private endpoints per region and 100 per account.
    • Is there an issue using Portal creation and CLI approval?
      No documented issue. Creating the Private Endpoint in the portal and approving via CLI is supported; the problem is more likely related to Databricks-side limits or configuration.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Jose Benjamin Solis Nolasco 12,281 Reputation points Volunteer Moderator
    2026-06-17T23:54:30.2233333+00:00

    Welcome to Microsoft Q&A,

    Hello @YH I hope you are doing well,

    To directly answer your two questions:

    1. Is there an issue using Portal creation and CLI approval? No. Azure Resource Manager (ARM) is entirely agnostic to the management plane tool used. Creating the resource via the Azure Portal and approving it via Azure CLI (az network private-endpoint-connection approve) is a fully supported and standard workflow.

    2. Is there a connection limit in Databricks workspaces? Yes. Unlike Azure Storage which allows hundreds of private endpoints, Azure Databricks has a hard limit of 5 private endpoints per workspace for front-end (inbound) connections (databricks_ui_api).

    Why is it stuck in Pending? When you approve the PE via the CLI, you are interacting with the Azure Resource Manager. ARM then sends a sync request to the Databricks Control Plane to finalize the connection. If the connection remains stuck in "Pending", it means the sync between ARM and the Databricks backend failed. This typically happens for three reasons:

    Quota Exhaustion: You have hit the 5 PE limit on the target workspace, so the Databricks Control Plane silently rejected the approval sync.

    Incorrect Group ID: The PE was requested using the wrong sub-resource target (e.g., requesting browser_authentication when you meant databricks_ui_api), causing a validation failure on the Databricks side.

    • State Desynchronization: A transient API timeout occurred between Azure and the Databricks infrastructure during the CLI approval execution.

    The Remediation: Because the state is now wedged between ARM and Databricks, you cannot force the approval through. You must delete the pending Private Endpoint connection from the Databricks workspace's Networking blade, verify you are under the 5 PE limit, and recreate the PE request.

    Verify privateLinkServiceConnectionState.status = Approved in the PE JSON; copy the exact resource ID used in approval.

    Compare with working Blob PE: export both PE JSONs and highlight differences (resource IDs, subresource, connectionState).

    Check Databricks account PE rules on the Network connectivity configurations page for the workspace/account; confirm it’s not at quota.

    Retry approval via portal UI in the Databricks subscription (to rule out CLI parameter mismatch).

    If still Pending: gather the artifacts above and open an Azure Databricks support case (include PE JSON, CLI output, activity logs, timestamps, and a working Blob PE example).

    😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.