Databricks workspace got into a failed state

Question

Databricks workspace got into a failed state

Berisha, Edon (C) 0

I tried to disable public network access on workspace, and during the apply of that, the workspace got into failed state.
I didn't have any type of this errors before.
What could be wrong? And how do I fix this?

0 comments

2 answers

Your answer

Answer 1

Hi @Berisha, Edon (C)

Review the Activity Log

Azure Portal → Workspace → Activity Log

Look for the failed Update operation.

Open the error details and note the error code/message.

Verify private connectivity For services such as Azure Synapse, disabling public network access requires access through private endpoints. When public access is disabled, connections are expected to use private endpoints instead of the public interface.
Check Resource Health

Azure Portal → Workspace → Resource Health

Verify whether Azure reports any platform-side issue.

Try reverting the setting If the workspace is still accessible through ARM operations, try re-enabling Public Network Access and check whether the resource returns to a healthy state. Microsoft notes that after re-enabling public access, it can take some time before connectivity operations fully recover.

Thanks.

Answer 2

Maksood Ahmed 15 Microsoft External Staff Moderator

Hi @Berisha, Edon (C) ,

Since the workspace went into a Failed state while disabling Public Network Access, first check the failed update in Azure Portal > Databricks workspace > Activity log. The Activity Log should show why the networking change failed.

If the error shows ScopeLocked, ResourceDeploymentFailure, or WorkspaceUpdateFailed, check whether there is a resource lock on the VNet or its resource group. A resource-group lock can prevent the Databricks networking update from completing and leave the workspace in a Failed state.

Please try the following:

Stop any running Databricks clusters/jobs before changing the workspace network settings.
Check the VNet and its resource group for a Delete/ReadOnly lock. If the Activity Log confirms the lock is blocking the update, remove it temporarily.
Retry the workspace network update.
Make sure the required private networking configuration is working before disabling Public Network Access. Microsoft recommends completing the network migration first with public access enabled, confirming the workspace is operational, and then disabling public access.
If the workspace remains in the Failed state, please share the exact error from the failed Activity Log operation. That will help identify whether the failure is caused by the network configuration, a resource lock, or another deployment error.

There is no need to recreate the workspace until the actual deployment error has been checked.

FYR:

Update Azure Databricks workspace network configuration

Berisha, Edon (C) 0 Reputation points

2026-10-02T11:59:30.59+00:00

So the confirmed error is:

"Unprepare a subnet" is failing and after this a new error happens "Delete Network Intent Policy" failure.

Connecting via a VPN is working right now, so I need only disabling public network access. (I reverted the setting and now it is working , but not the desired result)

I mean when I created the Databricks workspace with Azure rules, I changed some of them, put my own NSG in subnets.
Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-02T13:12:23.78+00:00

Hi @Berisha, Edon (C) ,

Thank you for the additional details.

Since the workspace is working after you reverted Public Network Access, please keep the current working configuration for now.

As you mentioned that you changed some of the original Databricks network rules and applied your own NSG to the subnets, I recommend checking those changes first. Make sure both Databricks subnets and the associated NSG configuration still meet the Azure Databricks networking requirements.

The “Unprepare a subnet” followed by “Delete Network Intent Policy” error shows that the failure is occurring while Azure is processing the subnet/network change. Please do not manually delete the Network Intent Policy.

After reviewing the subnet and NSG configuration, try disabling Public Network Access again.

If the operation still fails, please share the complete error message from the failed Delete Network Intent Policy operation in the Activity Log, including the error code and correlation ID if available. This will help us narrow down what is blocking the update.

FYR:

Azure Databricks Private Link networking
Berisha, Edon (C) 0 Reputation points

2026-10-02T13:34:00.0266667+00:00

Hey thanks for reply.
What I did now is just attached the default NSG to subnets, and retried the operation. This time it was successful.

Changes are done, but until it reflects it is taking a long time sometimes even after the changes are done successfully.
For example in a different workspace network configurations to actually reflect took more than 5-6 hours. Even that the template showed that change was successfully done.

So the solution to bring back the default NSG was correct. Thank you
Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-02T14:37:47.6533333+00:00

Hello,

Thank you for the update. Glad to know that restoring the default NSG resolved the issue and the network configuration change completed successfully.

Since the reported issue is now resolved, could you please confirm if we can proceed with closing this thread?

Regards,

Maksood