Menu
Ensure Azure Databricks is deployed in a customer-managed VNet
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-2-1-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-foundations-2.1.1 |
| description | Ensure Azure Databricks is deployed in a customer-managed VNet |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","databricks","analytics"] |
| cis_id | 2.1.1 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-2.1.2","cis-azure-foundations-2.1.9","cis-azure-foundations-2.1.11"] |
| prerequisites | [] |
| severity_boost | {} |
Networking for Azure Databricks can be set up in a few different ways. Using a customer-managed Virtual Network (VNet) (also known as VNet Injection) ensures that compute clusters and control planes are securely isolated within the organization's network boundary. By default, Databricks creates a managed VNet, which provides limited control over network security policies, firewall configurations, and routing.
Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for:
Run the following command to check if Databricks is using a customer-managed VNet:
az network vnet show --resource-group <resource-group-name> --name <vnet-name>
Ensure that Databricks subnets are present in the VNet configuration. Validate NSG rules attached to the Databricks subnets.
Get-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> | Select-Object VirtualNetworkId
If VirtualNetworkId is null or shows a Databricks-Managed VNet, it is non-compliant.
9c25c9e4-ee12-4882-afd2-11fb9d87893f - Name: 'Azure Databricks Workspaces should be in a virtual network'The workspace should show a customer-managed VNet with properly configured subnets and NSG rules. The VirtualNetworkId should point to an organization-owned VNet resource.
Deploy a new Databricks workspace in a custom VNet:
az databricks workspace create --name <databricks-workspace-name> \
--resource-group <resource-group-name> \
--location <region> \
--managed-resource-group <managed-rg-name> \
--enable-no-public-ip true \
--network-security-group-rule "NoAzureServices" \
--public-network-access Disabled \
--custom-virtual-network-id /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>
Ensure NSG Rules are correctly configured:
az network nsg rule create --resource-group <resource-group-name> \
--nsg-name <nsg-name> \
--name "DenyAllOutbound" \
--direction Outbound \
--access Deny \
--priority 4096
New-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> -Location <region> -ManagedResourceGroupName <managed-rg-name> -CustomVirtualNetworkId "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>"
By default, Azure Databricks uses a Databricks-Managed VNet.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 12.2 Establish and Maintain a Secure Network Architecture | x | x | |
| v7 | 14.1 Segment the Network Based on Sensitivity | x | x |
Level 1 | Automated