NCC (Network Connectivity Configuration) Overview: A Practical Guide to Azure Databricks Serverless Connectivity
NCC in the supplied official documentation means Azure Databricks Network Connectivity Configuration, not a certification vendor or credential family. It is an account-level, regional way to manage private connectivity from serverless compute to Azure resources. This overview helps Azure Databricks account administrators, workspace owners, security teams, and platform engineers decide whether an NCC fits their access model, how private endpoint rules work, and which implementation questions to settle before proceeding. Readers comparing certification paths should note that the available evidence describes a platform networking feature rather than exams, badges, or certification levels.
Start by identifying what NCC means in your environment
NCC is an Azure Databricks networking construct used to manage private endpoint creation for serverless compute. Account administrators create NCCs in the account console, then attach them to one or more workspaces so serverless workloads can reach selected Azure resources through private connectivity.
This distinction matters because “NCC” can refer to different organizations, products, or programs in other contexts. The supplied official evidence does not document an NCC certification program, credential ladder, exam, training catalog, or renewal policy. It does document Azure Databricks Network Connectivity Configurations, so the guidance here is intentionally limited to that product feature.
The best next step is therefore not to search for an NCC certification level. Instead, determine whether your requirement concerns private access from Azure Databricks serverless compute, firewall allowlisting, Databricks Apps, Serverless Private Git, or another networking design. The relevant choice is an architecture and administration decision, not a credential-selection decision.
Who should use this overview
This material is most useful to Azure Databricks account administrators who create and attach NCCs, security teams controlling access to private resources, workspace owners using serverless compute, and engineers responsible for Azure load balancers, Private Link services, DNS, or private Git infrastructure.
It can also help learning managers avoid assigning the wrong type of training. A reader looking for a formal certification should verify the intended vendor and credential name first, because the supplied NCC documentation does not establish any certification ecosystem.
Choose NCC when private serverless access is the actual requirement
NCC is the relevant design path when serverless compute must connect privately to customer-managed Azure resources and the organization wants access controlled through Azure Private Link. When a private endpoint is added to an NCC, Azure Databricks creates a private endpoint request to the Azure resource. The resource owner must approve that request before serverless compute can use the connection.
The private endpoint is dedicated to the Azure Databricks account and is accessible only from authorized workspaces. NCC private endpoints are supported from SQL warehouses, jobs, notebooks, Lakeflow pipelines, and model-serving endpoints. This makes the construct relevant across several serverless workloads rather than limiting it to one Databricks interface.
NCC is not automatically the answer for every serverless connection. Azure Databricks can use service endpoints, private IPs, or public IPs depending on the resource location, configuration, and type. If no private endpoint is configured, serverless compute connects to Azure Storage using service endpoints and to other resources using NAT IPs, according to the serverless networking overview.
When another control may be more appropriate
If the requirement is to allowlist stable serverless subnet identifiers on an Azure Storage firewall, the Databricks Apps networking documentation describes NCCs as providing stable subnet IDs that can be added to a storage account firewall. If the requirement is outbound restriction for Databricks Apps, network policies may be the more relevant control; the documentation states that network policies are available only on the Premium tier.
If the requirement concerns inbound access to a Databricks App, examine IP access lists or front-end private connectivity rather than treating NCC as an all-purpose ingress mechanism. The Apps documentation separates ingress controls from NCC-based egress controls.
If the requirement is to connect a workspace to a private Git server through serverless compute and Azure Private Link, use the Serverless Private Git design. That feature requires a workspace with serverless compute, a private Git server in the same Azure VNet as the Standard Load Balancer, a signed certificate, and a valid HTTPS fully qualified domain name.
Check the prerequisites before designing the connection
The official Azure Databricks documentation identifies several prerequisites for private connectivity. The Azure Databricks account and workspace must be on the Premium plan, and the person configuring the connection must be an Azure Databricks account administrator. At least one workspace must use serverless compute.
The Azure resource side also needs preparation. For VNet resources, the documented design uses an Azure Load Balancer as the frontend for the VNet resources and an Azure Private Link service to expose that load balancer to the private endpoint. The load balancer needs a frontend IP configuration, a backend pool containing the VNet resource addresses, a health probe, and load-balancing rules.
The Private Link service must be in the same region as the load balancer. The resource owner also needs a process for reviewing and approving the private endpoint request generated when the NCC rule is created. Treat that approval as part of the implementation plan rather than as an automatic provisioning step.
Regional and capacity checks
NCCs are regional and can be attached only to workspaces in the same region. Each Azure Databricks account can have up to 10 NCCs per region. Each region can have 100 private endpoints, distributed as needed across 1-10 NCCs, and each NCC can be attached to up to 50 workspaces.
These limits should influence the design before separate NCCs are created for every workspace. The documentation recommends sharing an NCC among workspaces in the same business unit and region. It also gives a reason to separate configurations: if some workspaces use Private Link and others use firewall enablement, separate NCCs may be appropriate.
For Azure China, the documentation states that NCCs are supported only in the China North 3 region. Because an NCC can be attached only to a workspace in the same region, both the workspace and NCC must be in China North 3 for that scenario. The documentation also states that each account can have up to 20 private endpoints in Azure China.
Plan the resource naming and DNS model
A private endpoint rule for VNet private connectivity supports up to 100 domain names. DNS chasing and DNS redirect are not supported, so each domain name must resolve directly to the backend resources. This is a design constraint, not merely a configuration detail: the DNS team should confirm that the names used by workloads resolve in the expected way before the rule is submitted.
For Serverless Private Git, the private Git server must have a valid HTTPS fully qualified domain name and signed certificate. The private Git setup also requires DNS logic in the private endpoint rule. If a workspace connects to multiple private Git servers, they must use the same NCC because only one NCC can be configured per workspace for Serverless Private Git.
Understand the NCC operating model before implementation
The account console is the central administration point described by the official documentation. An account administrator creates the NCC, attaches it to workspaces, and adds private endpoint rules that identify the private resources to which serverless compute should connect.
The workflow has two administrative domains. Azure Databricks administrators manage the NCC and its rules, while the owner of the Azure resource approves the corresponding private endpoint request. A successful design therefore needs coordination between the Databricks account team, the Azure networking team, and the resource owner.
NCC private endpoints are not a general tunnel for every destination. They define private connectivity to specified resources or backend services. For Azure Storage, the required sub-resource type can matter: the documentation identifies blob or dfs for object storage access and web for Azure Static Website hosting. Azure Cosmos DB can require Sql or MongoDB as the sub-resource type.
The practical sequence
Begin by identifying the serverless workload and the target Azure resource. Confirm that the workspace and account satisfy the Premium plan and account-administrator requirements, then verify regional alignment.
Next, prepare the Azure side. For a VNet resource behind a load balancer, configure the load balancer, backend pool, health probe, load-balancing rules, and Private Link service. Confirm that the Private Link service and load balancer share a region.
Create or select the NCC in the Azure Databricks account console, attach it to the intended workspace or workspaces, and add the private endpoint rule with the correct resource identifier, sub-resource type, and directly resolving domain names.
Finally, monitor the rule status, coordinate approval with the resource owner, and test the workload from its actual serverless surface. A connection that works from classic compute does not by itself prove that the serverless route is correctly configured.
What the rule statuses tell you
The documented private endpoint rule statuses are PENDING, ESTABLISHED, REJECTED, DISCONNECTED, and EXPIRED. PENDING means approval is still outstanding on the resource. ESTABLISHED indicates that the connection is established on the resource. REJECTED and DISCONNECTED identify unsuccessful or no-longer-connected states, while EXPIRED indicates that the rule expired on the resource.
A private endpoint rule expires after being in the REJECTED, DISCONNECTED, or PENDING state for 14 days. Most changes to private endpoint rules propagate to serverless compute within 10 minutes, but complete application can take up to 24 hours. These timings should be treated as operational expectations from the official documentation, not as a substitute for checking the actual rule status and workload behavior.
If a rule is in ESTABLISHED, REJECTED, or DISCONNECTED state, Azure Databricks might retain the private endpoint on the cloud resource for 1 day before permanently deleting it after removal. Private endpoint rules are billed by Azure for each hour they exist, regardless of connection state, so unused rules should be deleted.
Decide how NCC fits different Azure Databricks workloads
The right NCC design depends on what the serverless workload needs to reach. SQL warehouses, jobs, notebooks, Lakeflow pipelines, and model-serving endpoints can use NCC private endpoints, but each workload may require different resource permissions, DNS records, sub-resource types, and testing.
For model serving, the documentation notes that model artifacts are downloaded from an Azure Blob Storage path, so the relevant storage private endpoint must be planned. Logging models in Unity Catalog from serverless notebooks can require a dfs private endpoint, and SecureConnect requires both blob and dfs private endpoints. These are workload-specific details that should be captured in the access design rather than assumed from a single successful storage test.
Databricks Apps add another decision layer. Apps run on the serverless compute plane and support ingress and egress controls. An NCC can help connect an app to Azure services, provide stable subnet IDs for storage firewall allowlisting, or support private destinations through serverless private endpoints or an Azure load balancer. Network policies can further restrict outbound traffic, but the documentation says they are available only on the Premium tier.
Databricks Apps networking questions
For an app that needs restricted inbound access, ask whether the requirement is an IP access list or front-end Private Link. Front-end private connectivity requires conditional DNS forwarding for the databricksapps.com domain so the app name resolves through the private endpoint instead of public IP addresses.
For an app that needs restricted outbound access, ask which Azure resources are approved, whether stable subnet allowlisting is sufficient, and whether private endpoints or an Azure load balancer are required. The app networking documentation also states that all network communications to and from apps are encrypted; user traffic uses TLS 1.3 between users and the app domain.
After changing network policies, redeploy or restart the app so the updated policies take effect. This is a practical operational step that belongs in the change procedure and validation checklist.
Serverless Private Git questions
Serverless Private Git is a separate use case built on the NCC and private connectivity model. It allows a Databricks workspace to connect to a private Git server using serverless compute and Azure Private Link. The feature is documented as being in Public Preview, so teams should review its current status and limitations before making it a production dependency.
Confirm that serverless compute is enabled, the Git server is private and located in the required VNet arrangement, the Standard Load Balancer and Private Link service are configured, and the certificate and HTTPS FQDN are valid. Only one NCC can be configured per workspace for Serverless Private Git, so multiple private Git servers used by that workspace must share the same NCC.
The documentation identifies a limitation for Serverless Private Git: serverless proxy logs are not available. Teams that require detailed proxy logging should include that limitation in their security and operational review.
Build a preparation approach around the platform role
Because the supplied evidence describes a networking feature rather than an exam, preparation should be role-based. An account administrator should learn account-console NCC creation, workspace attachment, private endpoint rule management, approval states, and regional limits. An Azure network engineer should focus on load balancers, Private Link services, backend resources, DNS, and resource-side approval.
A workspace owner should understand which serverless surfaces use the connection and what access each needs. A security or compliance reviewer should assess private access, firewall behavior, outbound controls, data exfiltration concerns, and the cost implications of private endpoint rules and cross-region traffic.
Use the official documentation as a configuration reference, then validate the design in a controlled workspace. The official pages describe account-console configuration and also reference an API for Network Connectivity Configurations. Teams that automate deployment should compare the documented API behavior with the current service documentation before writing production automation.
A useful study and readiness checklist
You are ready to plan an NCC when you can explain the difference between the Azure Databricks control plane, serverless compute plane, classic compute, an NCC, a private endpoint, and a Private Link service.
You should also be able to identify the resource owner who must approve the request, state which region the workspace and NCC use, choose the appropriate storage sub-resource type where relevant, and describe how DNS names resolve directly to backend resources.
For operational readiness, know how to recognize PENDING, ESTABLISHED, REJECTED, DISCONNECTED, and EXPIRED, how long an unresolved rule can remain before expiration, when propagation may require additional waiting, and how to remove unused rules to avoid ongoing Azure charges.
For Apps or Serverless Private Git, add the relevant app ingress and egress controls, certificate and FQDN requirements, one-NCC-per-workspace constraint, network policy behavior, and logging limitations to the review.
What not to use as evidence of readiness
A private endpoint that is approved but never tested from the intended serverless workload is not enough evidence that the design is complete. Likewise, a classic-compute test does not establish that serverless compute has the expected route, permissions, and DNS resolution.
Do not treat a copied configuration, an unofficial question bank, or a memorized list of limits as a substitute for understanding the resource relationships. The official documentation is the appropriate source for current limits, supported regions, supported resources, plan requirements, and feature status.
Compare the main implementation choices without oversimplifying them
Use Private Link through an NCC when the central requirement is private connectivity from serverless compute to selected Azure resources. This provides a dedicated private endpoint tied to the Azure Databricks account and authorized workspaces, but it requires resource-side setup, approval, DNS planning, and ongoing rule management.
Use stable serverless subnet identifiers and firewall controls when the resource and governance model are better suited to allowlisting. This can be useful for Azure Storage and Databricks Apps, but it is not interchangeable with every Private Link design. Review the current Azure Databricks network security perimeter guidance when firewall-based access is the chosen approach.
Use network policies for Databricks Apps when the need is to restrict outbound destinations or enforce egress controls. This is an app and serverless-network policy decision, not a replacement for configuring a private endpoint to a specific Azure resource.
Use the Serverless Private Git path when the target is a private Git server. Its requirements and limitations differ from ordinary storage or database connectivity, and its Public Preview status should be considered before adoption.
Questions for a design review
Which serverless workloads need access, and which Azure resources do they actually require?
Is the goal private routing, firewall allowlisting, outbound domain restriction, inbound app protection, or a combination of controls?
Are the account and workspace on the Premium plan, and does the implementer have Azure Databricks account-administrator access?
Are the workspace, NCC, load balancer, and Private Link service in compatible regions?
Who owns approval of the private endpoint request on the Azure resource?
Do all required domain names resolve directly to backend resources without DNS chasing or DNS redirect?
Will the NCC be shared across workspaces in the same business unit and region, or should separate configurations isolate different connectivity models?
How will the team monitor rule states, test propagation, remove stale rules, and account for networking and private endpoint charges?
Review cost, security, and lifecycle implications
NCC improves control over serverless connectivity, but it does not eliminate the need for cost and security review. Azure Databricks charges for networking costs when serverless workloads connect to customer resources and when performance-intensive services egress data cross-region back to clients. The official documentation directs readers to the Databricks networking cost guidance for billing details.
Private endpoint rules are billed by Azure for each hour they exist, regardless of connection state. A rejected or disconnected rule should not be left indefinitely if it is no longer needed. Deleting an unused rule is both a lifecycle task and a cost-control measure.
From a security perspective, private connectivity adds a network defense layer by placing resources in private network locations and controlling access through dedicated private endpoints. It should be evaluated alongside identity, permissions, storage controls, Unity Catalog governance, firewall rules, and application-level protections rather than treated as a complete security program.
Serverless compute runs in an Azure Databricks-managed serverless compute plane. The official overview states that connectivity between the control plane and serverless compute plane stays on the cloud network backbone rather than the public internet. That architectural fact helps explain the scope of NCC: it manages connectivity from serverless compute to customer resources, not every network relationship in the platform.
Plan for change management
Document each NCC’s purpose, region, attached workspaces, private endpoint rules, resource owners, DNS dependencies, and intended workloads. This makes it easier to distinguish a rule that is waiting for approval from one that is no longer required.
When changing a private endpoint rule, allow for the documented propagation window and test the affected workload after the change. If network policies are changed for a Databricks App, redeploy or restart the app so the updated policies take effect.
Review regional capacity before adding new workspaces or private endpoints. The documented limits of 10 NCCs per region, 100 private endpoints per region, and 50 workspaces per NCC may affect whether an existing configuration can be extended or a new one should be designed.
Make the next step match the real goal
If your goal is secure access from Azure Databricks serverless compute to an Azure resource, start with the official private connectivity documentation and map the target resource, region, DNS names, Private Link service, NCC, and approval owner. If your goal is a Databricks App, separate ingress and egress requirements before deciding whether to use an NCC, a network policy, IP access lists, or front-end Private Link.
If your goal is private source-code access, review Serverless Private Git separately and account for its Public Preview status, one-NCC-per-workspace constraint, certificate requirements, and lack of serverless proxy logs. If your goal is professional certification, stop and verify the vendor name: the supplied evidence does not describe an NCC credential program.
The sensible learning path is therefore to identify the platform role, read the official feature documentation relevant to the workload, build a small controlled configuration, validate approval and DNS behavior, and then document the production design. That approach gives readers a defensible next step without implying that NCC has certification levels or exam requirements unsupported by the available sources.
Recommended official reading order
Begin with the serverless compute plane networking overview to understand where NCCs sit in the Azure Databricks network model: https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/
Read the private connectivity overview for NCC creation, workspace attachment, supported workloads, requirements, and regional limits: https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/serverless-private-link
For resources in a VNet behind an Azure load balancer, consult the configuration procedure and its DNS and domain-name constraints: https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/pl-to-internal-network
Use the private endpoint rule management documentation to review statuses, expiration, propagation, deletion, and lifecycle behavior: https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules
For app-specific controls, read the Databricks Apps networking documentation: https://learn.microsoft.com/en-us/azure/databricks/dev-tools/databricks-apps/networking
For private Git connectivity, review the Serverless Private Git documentation: https://learn.microsoft.com/en-us/azure/databricks/repos/serverless-private-git
Conclusion
The supplied official evidence supports an overview of Azure Databricks Network Connectivity Configuration, not a certification vendor or credential ecosystem. NCC is best understood as an account-level, regional control for managing private connectivity from serverless compute to Azure resources. Choose it when private endpoints, resource-owner approval, regional planning, DNS control, and serverless workload access are central requirements. For certification research, verify the intended vendor separately; for NCC implementation, use the official Azure Databricks documentation and validate the design against current requirements, limits, supported regions, feature status, and costs.
