Databricks releases, every cloud
- Arm-based instances are now supported with the compliance security profile
Supports all compliance standards, previously unsupported.
- Block specific internet destinations in network policies (Public Preview)
Blocks destinations regardless of network access mode, enforced through REST API.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Lakeflow Designer will soon be available by default for workspaces with the compliance security profile enabled Coming soon
Replaces manual coding for data preparation and transformation. Available late July 2026.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Azure Databricks UI assets will be served from a new CDN domain Coming soon
Replaces existing domain, requires firewall update to ui-assets.azuredatabricks.net.
- Private Link for account-level resources (Beta)
Connects account console through VPC interface endpoint instead of public internet. Requires configuration.
- Email notifications for expiring service principal tokens (Beta)
Sends emails to workspace admins when tokens expire in 7 days, requiring no configuration.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Run the change, do not just read it. Hands-on labs in your own Databricks workspace, graded when you submit. Browse labs
- Identity federation enabled by default for all new workspaces
Does not affect existing workspaces.
- Reorganized Spark Declarative Pipelines on Lakeflow documentation
Conceptual topics are now under Concepts.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Upcoming behavior change: Choose entitlements when adding principals to workspaces Coming soon
Grants entitlements explicitly when adding principals, replacing inheritance from users system group.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Intra-VNet NSG rule hardening for Azure Databricks is now in Public Preview
Restricts workspace traffic to host and worker subnet CIDRs. Applies to classic compute plane workspaces.
- Compliance security profile required for HIPAA, HITRUST, and IRAP Coming soon
Required starting September 1, 2026, for HIPAA, HITRUST, and IRAP data.
- Postgres password authentication is now disabled by default for new Lakebase projects
Existing projects are unaffected, enable in project settings to allow.
- Customer-managed keys for Lakebase available in all AWS and Azure regions
Encrypts project data at rest using a custom cloud KMS key. Available for new projects.
- Azure Databricks Add-in for Excel support for all compliance security profile standards
Supports all Azure Databricks compliance security profiles.
- Customer-managed keys now support MLflow managed evaluation features
Supports MLflow 3 scorers and requires non-CMK encrypted catalog.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - HIPAA support for the Azure Databricks Add-in for Excel
Available for workspaces with HIPAA compliance across all supported regions. Requires a workspace with HIPAA compliance enabled.
- Block identities from your Azure Databricks account with the account access denylist
Prevents access when automatic identity management is enabled, blocking specific users, groups, or service principals.
- Azure UK South now has a dedicated regional control plane
New workspaces require firewall allowlist entries for SCC relay tunnel and other IPs. Existing workspaces use UK West control plane unless migrated.
- Get this table by email. One Monday mail covering the week, filtered to the clouds and products you run. Weekly digest
- Configure private endpoints for serverless compute in Azure China
Requires China North 3 region and network connectivity configuration.
- Connect Azure Databricks to on-premises resources using an SSH reverse tunnel
Replaces inbound firewall access, works with classic and serverless compute.
- Workspace object permissions will soon be inherited from all account groups Coming soon
Inherited permissions include inactive grants from removed groups, potentially giving unexpected access. Users still need workspace assignment.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed keys now support model serving
Encrypts model serving container images and model artifacts in Databricks managed registry. Applies to endpoint artifacts created after April 16, 2026.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - C5, TISAX, and K-FSI compliance controls are now generally available
Available on Azure, providing enhancements for workspace compliance requirements.
- Upcoming breaking change: default behavior when deleting a Unity Catalog pipeline Coming soon
Deletes now retain associated tables by default, set cascade=true to remove them.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Scoped personal access tokens are now generally available
Restrict tokens to specific API operations with specified permissions. Coming soon to compliance security profile workspaces.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Inbound Private Link for performance-intensive services (Public Preview)
Enables private connectivity for Zerobus Ingest and Lakebase Autoscaling.
- Serverless compute now available for IRAP and Canada Protected B workloads on Azure Databricks
Requires environment version 5 to be enabled.
- Customer-managed keys for Unity Catalog
Uses own encryption keys for Unity Catalog data. Replaces automatic encryption.
- Update workspace network configuration to VNet injection is now GA
Migrates from Databricks-managed VNet to customer-owned VNet.
- ISMAP compliance support
Supports Japanese government cloud certification, requires configuration changes.
- Azure virtual network service endpoint policies are now generally available
Apply to classic compute for outbound storage access filtering. Requires configuration.
- Personal access tokens preserved when CAN USE permission is revoked
Tokens become unusable but not deleted when permission is revoked, and reactivate if restored.
- Inbound Private Link for performance-intensive services (Beta)
Enables private connectivity to Zerobus Ingest and Lakebase Autoscaling.
- Scoped personal access tokens (Beta)
Limits permissions by selecting token type and API scopes, replacing legacy tokens.
- Automatic identity management deactivates deleted Entra ID users
Replaces "Active: Removed From EntraID" status with Deactivated.
- Improved group sharing for automatic identity management
Shares account-level assets with Microsoft Entra ID groups. Requires automatic identity management.
- Simplified serverless network security with Azure Network Security Perimeter
Uses AzureDatabricksServerless service tag, replacing subnet-based rules.
- Automatic email notifications for expiring personal access tokens (GA)
Sends emails 14 days before token expiration, requires token lifetime to be set.
- Context based ingress control is now in Public Preview
Enables account admins to set allow and deny rules based on identity, request type, and network source.
- Automatic email notifications for expiring personal access tokens (Public Preview)
Sends emails 7 days before token expiration.
Headlines, dates and product areas are Databricks' own, and every item links to the note it came from. The one-line summaries are ours.