databricks Platform · Updated Jun 23, 2026

Block Specific Internet Destinations

Enhance security by blocking unwanted internet access from serverless workloads.

Public Preview Open docs ↗release note ↗

What it does

This feature allows users to block specific internet destinations from serverless workloads via the network policies REST API. Blocked destinations are enforced regardless of the policy's network access mode, providing a lightweight alternative to restricted access mode for blocking known-bad domains. The API requires an account admin OAuth token for configuration, and blocked destinations take precedence over allowed destinations.

Why it matters

By enabling the blocking of specific internet destinations, organizations can enhance their security posture, reducing the risk of exposure to malicious domains. This feature is particularly beneficial for compliance and governance, allowing data and platform leaders to enforce stricter network controls without overhauling existing policies. It supports better risk management and can lead to improved operational efficiency.

Key capabilities

Block Internet Destinations

Users can specify fully qualified domain names (FQDNs) to block, enhancing security against known threats.

API Management

Configuration is done through a REST API, requiring OAuth tokens for secure access.

Policy Enforcement

Blocked destinations are enforced regardless of the overall network access mode, ensuring consistent security.

Logging Denials

Denials of access to blocked destinations are logged for auditing and compliance purposes.

Prerequisites

Databricks workspace must be on the Enterprise tier.

Permissions for managing network policies are restricted to account admins.

Recommended use cases

Blocking access to known malicious domains.Enforcing compliance with corporate security policies.Preventing data exfiltration through unwanted internet access.

Limitations · remember

!IP ranges and storage destinations cannot be blocked.

!The maximum number of supported blocked destinations is not specified.

!Blocked destinations cannot be subdomains of allowed destinations.

Architecture

Databricks Workspace → Network Policies → Serverless Workloads → API Management

Get started

Retrieve Network Policy

Use the GET request to retrieve your current network policy.

Edit Policy JSON

Add blocked internet destinations to the retrieved policy JSON.

Submit Updated Policy

Use a PUT request to submit the updated network policy.

Verify Policy Enforcement

Test access to blocked domains to ensure enforcement is active.

Monitor Denial Logs

Check the system.access.outbound_network table for logged denials.

Key takeaway

The ability to block specific internet destinations enhances security for serverless workloads, allowing for more granular control over outbound network access.

2026-06-23-block-specific-internet-destinations-in-network-policies-public-preview Generated by the Databricks Updates Agent · browse all updates