Databricks releases, every cloud
- Unused OAuth client secrets are automatically deleted after 90 days
Deletes unused secrets after 90 days, create new if still needed.
- Restrict service principal OAuth secrets to specific API scopes
Restricts OAuth secrets to specific API scopes like sql or jobs, limiting leaked secret impact.
- Inbound Private Service Connect for performance-intensive services (Beta)
Enables private connectivity to services like Zerobus Ingest and Lakebase Autoscaling on Google Cloud.
- Block or redact sensitive data in requests and responses
Detects SSNs, credit cards, and phone numbers using regex and checksums. Requires Enhanced Unity Gateway preview.
- Cross-workspace access for serverless (Beta)
Controls serverless network traffic between workspaces with ingress and egress rules.
- ABAC GRANT policies now cover Unity Gateway resource types (Beta)
Supports model services, model provider services, MCP services, and agent services, allowing tag-based access.
- Run the change, do not just read it. Hands-on labs in your own Databricks workspace, graded when you submit. Browse labs
- READ METADATA privilege is GA
Provides read-only visibility into security-sensitive metadata, including privilege grants and ABAC policies.
- Create a least-privilege Databricks workspace
Grants Databricks a narrow set of custom IAM roles instead of broad permissions on Google Cloud.
- Allowlist partner platform IPs in context-based ingress control (Beta)
Supports Power BI, Tableau Cloud, and dbt platform, with automatic IP list updates.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Change to default pipeline editor for workspaces with the compliance security profile enabled Coming soon
Replaces legacy editor, removing it in August.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Email notifications for expiring service principal tokens (Beta)
Sends emails to workspace admins when tokens expire in 7 days, requiring no configuration.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Reorganized Spark Declarative Pipelines on Lakeflow documentation
Conceptual topics are now under Concepts.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Genie Code now supports auto-approve for tool actions
Approves tool actions without prompts, using an AI classifier to block risky ones.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed keys now support MLflow managed evaluation features
Supports MLflow 3 scorers and requires non-CMK encrypted catalog.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Databricks Add-in for Excel support for all compliance security profile standards
Supports all Databricks compliance security profiles. Requires Public Preview.
- HIPAA support for the Databricks Add-in for Excel
Available for workspaces with HIPAA compliance across all supported regions.
- Automatic identity management
Syncs users and groups from identity providers like Microsoft Entra ID and Okta.
AWS, read it on their docsAzure(not on this cloud)GCP, read it on their docsSAP, read it on their docs - Connect Databricks to on-premises resources using an SSH reverse tunnel
Uses proxy VMs in AWS, replacing inbound firewall access.
- Get this table by email. One Monday mail covering the week, filtered to the clouds and products you run. Weekly digest
- Workspace object permissions will soon be inherited from all account groups Coming soon
Inherited permissions include inactive grants from removed groups, potentially giving unexpected access. Users still need workspace assignment.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed keys now support model serving
Encrypts model serving container images and model artifacts in Databricks managed registry. Applies to endpoint artifacts created after April 16, 2026.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Workspace skills for Genie Code are now available
Workspace admins can create shared skills for machine learning pipelines and domain-specific processes.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Databricks Documentation site table of contents tabs
Replaces static sidebar with tabbed navigation, includes 6 context tabs.
- Databricks Assistant is now Genie Code
Adds autonomous multi-step data tasks, replaces Databricks Assistant.
AWS, read it on their docsAzure, read it on their docsGCP, read it on their docsSAP(not on this cloud) - Customer-managed keys for Unity Catalog (Beta)
Uses own encryption keys for Unity Catalog catalogs. Replaces automatic encryption.
- Change to use_case field in VPC endpoint API responses Coming soon
Changes from WORKSPACE_ACCESS to GENERAL_ACCESS, see API docs for details.
- Personal access tokens preserved when CAN USE permission is revoked
Tokens become unusable but not deleted when permission is revoked, and reactivate if restored.
- Scoped personal access tokens (Beta)
Limits permissions by selecting token type and API scopes, replacing legacy tokens.
- Connect Databricks Assistant to MCP servers
Connects to external tools and data sources through MCP servers, requiring permission to use added servers.
- Automatically provision users (JIT) GA
Creates accounts during SSO login if none exist. Requires single sign-on setup.
- Automatic email notifications for expiring personal access tokens (GA)
Sends emails 14 days before token expiration, requires token lifetime to be set.
- Create skills for Databricks Assistant
Extends Databricks Assistant with domain-specific tasks, following the open Agent Skills standard.
- Expanded regional availability for C5 and TISAX compliance
Now available in all regions and with serverless compute.
- Delta Sharing views automatically permitted in serverless network policies
Permitted regardless of storage location alignment between shared tables and view dependencies. Simplifies network policy configuration.
- TISAX compliance controls
Enhances workspace compliance based on ISO/IEC 27001 and VDA ISA.
- The Data Science Agent can now also use models served through Anthropic on Databricks
Uses models served through Anthropic when partner-powered AI features are enabled. Requires partner-powered AI features to be enabled.
- Notebook improvements
Cell execution minimap appears in right margin, supports up to 100MB notebooks.
- Databricks Assistant integrated with compute
Creates compute resources, pools, and policies, and answers questions about them. Available on some compute pages.
- Databricks-hosted models for Assistant are now GA
Available on all cloud platforms at no extra cost.
- Databricks Assistant: User and workspace instructions now available
Custom instructions can be added by users or admins, applying to all Assistant experiences.
- Edit mode in Assistant does multi-cell code refactoring and more
Performs reasoning and editing across multiple cells without manual intervention.
Headlines, dates and product areas are Databricks' own, and every item links to the note it came from. The one-line summaries are ours.