How do I connect to my AKS from Azure databricks Serverless workspace?

Question

How do I connect to my AKS from Azure databricks Serverless workspace?

Akash S 6

How do I connect to my AKS from Azure databricks Serverless workspace? My Serverless workspace is private endpoint enabled. Is it possible to connect via NCC? If not, what options we have? Connection should be all private without any public.

Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-12T10:57:09.7966667+00:00

Hi Akash S

Yes, this can be achieved using Databricks Serverless NCC and a Private Endpoint. The AKS application can be accessed privately through the Azure Standard Load Balancer, without exposing it to the public internet.
Akash S 6 Reputation points

2026-08-13T06:09:40.39+00:00

Hi Jose & Himaja,

Thanks for your response.

Do we have Private endpoint facility in AKS? I don't see one, instead I can see it is injected with Vnet. Hope AKS with Vnet injected can be used for AKS to DBX connectivity. ( AKS Vnet-subnet to DBX Private endpoint Subnet )

How about DBX to AKS? Is it still going via AKS private-endpoint? As I don't see a tab for private endpoints under Networking?

If so, which domain that I need to give for AKS in NCC? Is it API server address?
Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-13T13:15:35.3633333+00:00

Hi Akash S,

1)Yes, AKS VNet integration can be used for DBX connectivity.

2)Make sure VNet connectivity, routing, and Private DNS are configured correctly.

3)AKS Private Endpoint is not required for general application connectivity. It is mainly needed for private access to the AKS API Server.

4)For NCC, provide the required private endpoint/FQDN of the target resource. If accessing the AKS API Server, use the private API server FQDN, not the public address.
Akash S 6 Reputation points

2026-08-13T13:24:22.8233333+00:00

I don't see AKS is in supported resources for Serverless private endpoint

. https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules#resources
Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-13T13:39:07.81+00:00

Hi Akash S,

You are correct that AKS is not listed as a direct supported resource for Serverless NCC private endpoint rules. Therefore, an AKS resource itself cannot be selected directly in the NCC private endpoint rule.

For a private Databricks Serverless → AKS application connection, the supported approach is to expose the AKS application through an Azure Standard Load Balancer and configure the NCC private connectivity to the resource behind the Standard Load Balancer. The required DNS/FQDN should resolve directly to the private backend; DNS redirection/chaining is not supported.

The AKS API server FQDN should not be used simply to access an application running inside AKS. The API server is for Kubernetes API access and is a separate scenario.

If the requirement is Serverless Databricks → AKS application with no public connectivity, please confirm that the application is exposed through an Azure Standard Load Balancer/private endpoint architecture, and we can advise further on the NCC configuration.

1 answer

Your answer

Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-12T10:57:09.7966667+00:00

Hi Akash S

Yes, this can be achieved using Databricks Serverless NCC and a Private Endpoint. The AKS application can be accessed privately through the Azure Standard Load Balancer, without exposing it to the public internet.
Akash S 6 Reputation points

2026-08-13T06:09:40.39+00:00

Hi Jose & Himaja,

Thanks for your response.

Do we have Private endpoint facility in AKS? I don't see one, instead I can see it is injected with Vnet. Hope AKS with Vnet injected can be used for AKS to DBX connectivity. ( AKS Vnet-subnet to DBX Private endpoint Subnet )

How about DBX to AKS? Is it still going via AKS private-endpoint? As I don't see a tab for private endpoints under Networking?

If so, which domain that I need to give for AKS in NCC? Is it API server address?
Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-13T13:15:35.3633333+00:00

Hi Akash S,

1)Yes, AKS VNet integration can be used for DBX connectivity.

2)Make sure VNet connectivity, routing, and Private DNS are configured correctly.

3)AKS Private Endpoint is not required for general application connectivity. It is mainly needed for private access to the AKS API Server.

4)For NCC, provide the required private endpoint/FQDN of the target resource. If accessing the AKS API Server, use the private API server FQDN, not the public address.
Akash S 6 Reputation points

2026-08-13T13:24:22.8233333+00:00

I don't see AKS is in supported resources for Serverless private endpoint

. https://learn.microsoft.com/en-us/azure/databricks/security/network/serverless-network-security/manage-private-endpoint-rules#resources
Himaja Y 5 Reputation points Microsoft External Staff Moderator

2026-08-13T13:39:07.81+00:00

Hi Akash S,

You are correct that AKS is not listed as a direct supported resource for Serverless NCC private endpoint rules. Therefore, an AKS resource itself cannot be selected directly in the NCC private endpoint rule.

For a private Databricks Serverless → AKS application connection, the supported approach is to expose the AKS application through an Azure Standard Load Balancer and configure the NCC private connectivity to the resource behind the Standard Load Balancer. The required DNS/FQDN should resolve directly to the private backend; DNS redirection/chaining is not supported.

The AKS API server FQDN should not be used simply to access an application running inside AKS. The API server is for Kubernetes API access and is a separate scenario.

If the requirement is Serverless Databricks → AKS application with no public connectivity, please confirm that the application is exposed through an Azure Standard Load Balancer/private endpoint architecture, and we can advise further on the NCC configuration.

Answer 1

Hello @Akash S , I hope you are doing well,

Yes, you can keep the connection fully private.

The Databricks workspace Private Endpoint does not provide outbound connectivity from Serverless compute to AKS. For this scenario, use a Network Connectivity Configuration (NCC) with a private endpoint.

A typical architecture is:

Databricks Serverless → NCC → Private Endpoint → Standard Load Balancer → AKS service

This avoids exposing the AKS application through a public endpoint.

References:

Serverless private connectivity – Microsoft Learn

Private connectivity to resources in your VNet – Microsoft Learn

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.