Serverless compute plane networking
This page introduces tools to secure network access between the compute resources in the Databricks serverless compute plane and customer resources. To learn more about the control plane and the serverless compute plane, see Networking security architecture.
To learn more about classic compute and serverless compute, see Compute.
There are currently no networking charges for serverless features. In a later release, you might be charged. Databricks will provide advance notice for networking pricing changes.
Serverless compute plane networking overview
Serverless compute resources run in the serverless compute plane, which is managed by Databricks. Account admins can configure secure connectivity between the serverless compute plane and their resources. This network connection is labeled as 2 on the diagram below:
Connectivity between the control plane and the serverless compute plane is always over the cloud network backbone and not the public internet. On the serverless compute plane, traffic to Google APIs routes over the Google Cloud backbone.
For more information on configuring security features on the other network connections in the diagram, see Networking.
Configure stable project numbers
This feature is in Private Preview. To join this preview, contact your Databricks account team.
Google Cloud VPC Service Controls (VPC-SC) are used to define service perimeters that creates a security boundary around Google Cloud resources. Stable project numbers for the serverless compute plane enable you to create VPC-SCs between Databricks serverless compute plane and your GCP resources, such as GCS buckets. This ensures that only Databricks serverless SQL compute projects can access your resources. For more information, contact your Databricks account team.
Stable project numbers are only supported from SQL warehouses. They are not supported from other compute resources in the serverless compute plane.
Configure outbound IPs
This feature is in Private Preview. To join this preview, contact your Databricks account team.
Since mid-February 2026, Databricks publishes serverless outbound IPs in JSON format on a public endpoint, which is the supported method for retrieving these IPs.
If you use stable IPs from the legacy Private Preview, you must migrate to the new method before May 25, 2026. After May 25, 2026, legacy IP lists will be decommissioned and incomplete migrations might result in workload disruptions.
If the system hosting your external database has inbound access restrictions and is accessible from the internet, use outbound IPs to identify traffic from Databricks serverless compute.