How do I connect to my AKS from Azure databricks Serverless workspace?

Question

How do I connect to my AKS from Azure databricks Serverless workspace?

Akash S 6

How do I connect to my AKS from Azure databricks Serverless workspace? My Serverless workspace is private endpoint enabled. Is it possible to connect via NCC? If not, what options we have? Connection should be all private without any public.

Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-12T10:57:09.7966667+00:00

Hi Akash S

Yes, this can be achieved using Databricks Serverless NCC and a Private Endpoint. The AKS application can be accessed privately through the Azure Standard Load Balancer, without exposing it to the public internet.
Akash S 6 Reputation points

2026-08-13T06:09:40.39+00:00

Hi Jose & Himaja,

Thanks for your response.

Do we have Private endpoint facility in AKS? I don't see one, instead I can see it is injected with Vnet. Hope AKS with Vnet injected can be used for AKS to DBX connectivity. ( AKS Vnet-subnet to DBX Private endpoint Subnet )

How about DBX to AKS? Is it still going via AKS private-endpoint? As I don't see a tab for private endpoints under Networking?

If so, which domain that I need to give for AKS in NCC? Is it API server address?
Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-13T13:15:35.3633333+00:00

Hi Akash S,

1)Yes, AKS VNet integration can be used for DBX connectivity.

2)Make sure VNet connectivity, routing, and Private DNS are configured correctly.

3)AKS Private Endpoint is not required for general application connectivity. It is mainly needed for private access to the AKS API Server.

4)For NCC, provide the required private endpoint/FQDN of the target resource. If accessing the AKS API Server, use the private API server FQDN, not the public address.
Akash S 6 Reputation points

2026-08-13T13:24:22.8233333+00:00

I don't see AKS is in supported resources for Serverless private endpoint

. https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules#resources
Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-13T13:39:07.81+00:00

Hi Akash S,

You are correct that AKS is not listed as a direct supported resource for Serverless NCC private endpoint rules. Therefore, an AKS resource itself cannot be selected directly in the NCC private endpoint rule.

For a private Databricks Serverless → AKS application connection, the supported approach is to expose the AKS application through an Azure Standard Load Balancer and configure the NCC private connectivity to the resource behind the Standard Load Balancer. The required DNS/FQDN should resolve directly to the private backend; DNS redirection/chaining is not supported.

The AKS API server FQDN should not be used simply to access an application running inside AKS. The API server is for Kubernetes API access and is a separate scenario.

If the requirement is Serverless Databricks → AKS application with no public connectivity, please confirm that the application is exposed through an Azure Standard Load Balancer/private endpoint architecture, and we can advise further on the NCC configuration.

2 answers

Your answer

Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-12T10:57:09.7966667+00:00

Hi Akash S

Yes, this can be achieved using Databricks Serverless NCC and a Private Endpoint. The AKS application can be accessed privately through the Azure Standard Load Balancer, without exposing it to the public internet.
Akash S 6 Reputation points

2026-08-13T06:09:40.39+00:00

Hi Jose & Himaja,

Thanks for your response.

Do we have Private endpoint facility in AKS? I don't see one, instead I can see it is injected with Vnet. Hope AKS with Vnet injected can be used for AKS to DBX connectivity. ( AKS Vnet-subnet to DBX Private endpoint Subnet )

How about DBX to AKS? Is it still going via AKS private-endpoint? As I don't see a tab for private endpoints under Networking?

If so, which domain that I need to give for AKS in NCC? Is it API server address?
Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-13T13:15:35.3633333+00:00

Hi Akash S,

1)Yes, AKS VNet integration can be used for DBX connectivity.

2)Make sure VNet connectivity, routing, and Private DNS are configured correctly.

3)AKS Private Endpoint is not required for general application connectivity. It is mainly needed for private access to the AKS API Server.

4)For NCC, provide the required private endpoint/FQDN of the target resource. If accessing the AKS API Server, use the private API server FQDN, not the public address.
Akash S 6 Reputation points

2026-08-13T13:24:22.8233333+00:00

I don't see AKS is in supported resources for Serverless private endpoint

. https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules#resources
Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-13T13:39:07.81+00:00

Hi Akash S,

You are correct that AKS is not listed as a direct supported resource for Serverless NCC private endpoint rules. Therefore, an AKS resource itself cannot be selected directly in the NCC private endpoint rule.

For a private Databricks Serverless → AKS application connection, the supported approach is to expose the AKS application through an Azure Standard Load Balancer and configure the NCC private connectivity to the resource behind the Standard Load Balancer. The required DNS/FQDN should resolve directly to the private backend; DNS redirection/chaining is not supported.

The AKS API server FQDN should not be used simply to access an application running inside AKS. The API server is for Kubernetes API access and is a separate scenario.

If the requirement is Serverless Databricks → AKS application with no public connectivity, please confirm that the application is exposed through an Azure Standard Load Balancer/private endpoint architecture, and we can advise further on the NCC configuration.

Answer 1

Hi @Akash S ,

Yes, apart from Azure Standard Load Balancer, there are several Azure-native options available for enabling connectivity between Azure Databricks (DBX) and Azure Kubernetes Service (AKS), depending on your networking and security requirements.

Some commonly used approaches are:

Azure Application Gateway: Recommended when AKS workloads are exposed through HTTP/HTTPS endpoints and require Layer 7 routing, SSL termination, or Web Application Firewall (WAF) capabilities.
Azure Private Link / Private Endpoints: Recommended for secure private connectivity between Databricks and AKS services without exposing traffic to the public internet.
VNet Peering: Suitable when Databricks and AKS are deployed in different virtual networks and need private network connectivity.
Azure API Management (APIM): Useful when AKS services are exposed as APIs and require centralized authentication, authorization, throttling, and governance.
NGINX Ingress Controller or Application Gateway Ingress Controller (AGIC): Commonly used within AKS to expose and manage application traffic.

From a security and architecture perspective, if the requirement is to allow Azure Databricks to communicate privately with services hosted on AKS, the recommended approach is typically:

Azure Databricks → VNet Peering / Private Link → AKS Internal Service

This avoids exposing AKS services publicly while providing secure and controlled communication between the platforms.

To recommend the most appropriate solution, could you please clarify:

Is the AKS service exposed internally or externally?
Is Azure Databricks deployed with VNet Injection enabled?
Are you looking for private connectivity, API access, or load-balanced application access?

This information will help determine the best architecture for your scenario.

If this answer helps, please consider clicking Accept Answer so that other community members with similar requirements can benefit from it as well.

If you have any further questions, please let us know. We will be happy to assist.

Answer 2

Jose Benjamin Solis Nolasco 12,116 Volunteer Moderator

Hello @Akash S , I hope you are doing well,

Yes, you can keep the connection fully private.

The Databricks workspace Private Endpoint does not provide outbound connectivity from Serverless compute to AKS. For this scenario, use a Network Connectivity Configuration (NCC) with a private endpoint.

A typical architecture is:

Databricks Serverless → NCC → Private Endpoint → Standard Load Balancer → AKS service

This avoids exposing the AKS application through a public endpoint.

References:

Serverless private connectivity – Microsoft Learn

Private connectivity to resources in your VNet – Microsoft Learn

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

Jose Benjamin Solis Nolasco 12,116 Reputation points Volunteer Moderator

2026-08-18T23:20:45.3166667+00:00

@Akash S Just following up, Do you need more guidance or assistance ?
Akash S 6 Reputation points

2026-08-19T12:27:03.5833333+00:00

Hi, Apart from Standard load balancer, do we have any other services in Azure can help on connect with AKS from DBX?
Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-25T16:37:50.8266667+00:00

Hi @Akash S ,

Just checking in to see if the information provided earlier was helpful. Please let us know if you need any additional details or assistance, and we’ll gladly continue supporting you.