Allow partner platforms in context-based ingress policies

Partner platforms let you lock down public access to your workspace and still allow traffic from supported software as a service (SaaS) tools, such as Power BI, Tableau Cloud, and the Databricks Genie app for Slack. You select the partner in a context-based ingress rule, and Databricks keeps the partner's IP ranges or OAuth app details current, so you don't track partner IP addresses yourself.

This page lists the supported partner platforms and shows how to allow one in a workspace-level policy using the account console. For an overview of context-based ingress, see Context-based ingress control.

How partner platform rules match traffic

Databricks identifies partner traffic in one of the following ways, depending on the partner:

• Managed IP ranges: The partner publishes its egress IP addresses. Databricks syncs the published ranges every one to two weeks, and allows requests from these IPs. For some partners, you can limit rules to only allow traffic from given regions.
• Managed OAuth application: The partner product hosts a Databricks app, such as the Databricks Genie app for Slack or the Databricks Genie app in Microsoft Teams. Databricks identifies the traffic by the app's OAuth client ID and allows it only when it comes through Databricks services.

A partner platform rule allows only the partner's traffic source. Users and service principals still authenticate, and each request runs with the permissions of the identity that sent it.

Supported partner platforms

Partner platform	Match type	Region selection	Partner IP ranges	Setup guide
Microsoft Power BI	Managed IP ranges	Yes	Azure IP ranges and service tags	Publish to the Power BI service from Databricks
Tableau Cloud	Managed IP ranges	Yes	Tableau Cloud IP addresses	Connect Tableau and Databricks
dbt Cloud	Managed IP ranges	Yes	dbt Cloud IP addresses	Connect to dbt Cloud
Databricks Slack App	Managed OAuth application	No	Not applicable	Databricks Genie app for Slack
Databricks Teams App	Managed OAuth application	No	Not applicable	Databricks Genie app in Microsoft Teams

Partner platform	Match type	Region selection	Partner IP ranges	Setup guide
Microsoft Power BI	Managed IP ranges	Yes	Azure IP ranges and service tags	Publish to the Power BI service from Databricks
Tableau Cloud	Managed IP ranges	Yes	Tableau Cloud IP addresses	Connect Tableau and Databricks
dbt Cloud	Managed IP ranges	Yes	dbt Cloud IP addresses	Connect to dbt Cloud
Databricks Slack App	Managed OAuth application	No	Not applicable	Databricks Genie app for Slack
Databricks Teams App	Managed OAuth application	No	Not applicable	Databricks Genie app in Microsoft Teams

Region selection depends on whether the partner publishes its IP ranges by region.

Requirements

• You must be an account admin.
• Your Databricks account must be on the Enterprise tier.
• Public access must be enabled on the workspace. Partner platforms connect over the public internet. If public access is disabled, Databricks blocks their requests before it evaluates the ingress policy.

Public access is controlled by the Public access enabled setting in the workspace's private access settings. See Manage private access settings.

Limitations

• You can use managed OAuth applications, such as the Databricks Slack App and Databricks Teams App, in workspace-level policies only.
• You can add partner platforms to allow rules only, not deny rules.
• Each rule allows one partner platform. To allow several partners, add a rule for each partner.

You can also use managed IP range partners, such as Power BI, in the account-level policy. See Manage account context-based ingress policies.

Allow a partner platform using the account console

Open the workspace policy

Open or create the network policy for your workspace. See Access network policies.

Turn off access from all public IPs

On the Ingress tab, under Public Network Access, clear Allow access from all public IPs. The Allow Rules and Deny Rules lists appear.

Add an allow rule for the partner

1. Click Add Allow Rules.

2. Under Allow identities, select the Identities that can use the partner. To limit who can use the partner, choose specific users or service principals.

3. Under Source, for Source type, select Partner Platforms.

   

4. For Partner name, select the partner platform.

   

5. If the partner supports region selection, optionally select Regions. If you leave All regions selected, the rule allows all of the partner's regions.

   

6. Under Destination, select what the partner can access: Workspace UI, Workspace API, Lakebase runtime, or Apps runtime. To limit the partner to the APIs it needs, select Workspace API and choose specific API scopes. For example, for the Databricks Genie apps for Slack and Microsoft Teams, select the Genie API scope.

7. Add the rule.

Save, test, and attach the policy

1. Click Save to save the policy.
2. Set the Policy enforcement mode to Dry run mode, and attach the policy to your workspace. See Set the enforcement mode and Attach a policy to workspaces.
3. Check the system.access.inbound_network table for denied partner requests. See Check denial logs.
4. When the partner's requests are no longer denied, set the Policy enforcement mode to Enforced.

Additional resources

• • Manage workspace context-based ingress policies
  • Create workspace-level policies, configure public, private, and cross-workspace rules, and attach policies to workspaces.
• • Migrate workspace IP access lists to context-based ingress
  • Move existing workspace IP access lists into a context-based ingress policy.