The reason a job stays on classic compute is rarely the compute. It's that serverless had no private path to the Postgres instance in the VNet, the Artifactory behind the firewall or the on-premises system at the far end of an ExpressRoute, so a team keeps a cluster alive to reach them. Databricks announced Private Network Gateway on 14 October 2026, a managed gateway that gives serverless workloads one connection into your network, and says it is available in Public Preview on Azure. On AWS it's in Private Preview, with Google Cloud support described as in development.
This is what enterprise customers need, and we'd say so plainly. Reaching serverless workloads from inside an enterprise security perimeter makes work possible that wasn't before, and that's the whole value here. Every argument about serverless on a regulated estate ends at the network boundary, and this is the first mechanism that answers it at the network level instead of one connection at a time.
What we'd use it for #
The mechanism is one network-level setup. You configure a single connection into your network, and from there serverless can reach what your network can already reach, including connected on-premises environments. Databricks' design puts your existing routes, DNS and firewall rules in charge of what is reachable.
The first case we'd make is library installation, because serverless pulling Python packages from a private PyPI, Artifactory or Nexus removes one of the standard reasons a team keeps a classic cluster for a job with no other need of one. The second is ingestion: Lakeflow Connect on serverless compute reading supported databases across the VNet and connected on-premises environments, the shape of the CDC work described in change data capture and real-time data. An agent calling a private MCP server you host runs on the same path, and it's the piece that makes the private side of agents workable without keeping compute warm.
Egress is where we'd open the security review. Traffic can route through your existing firewall or content inspection service, so it's filtered and logged with tools the team already runs, and the gateway gives a consistent customer-owned source IP, which is what a SaaS allowlist wants to see.
The two things we'd watch #
It complements Private Link without replacing it. Databricks presents the gateway together with expanded Private Link support for Lakebase and account-level services, so the question on each target is which of the two your network owner would rather maintain. A gateway through which serverless can reach everything your network can reach is a wider boundary than one endpoint per service, and that conversation belongs with whoever owns the routes.
Then the bill. No source publishes a rate or a billing model for the gateway. We'd size any classic-compute retirement on the clusters that actually go away and leave the gateway as a cost line to be filled in later, the way we treat anything else without a rate in what it costs. Worth knowing too that the stage differs by cloud. Databricks announced Public Preview on Azure and Private Preview on AWS, so check which cloud a given statement refers to.
Where we'd start #
Pick one job that's on classic compute for network reasons alone, usually one installing from an internal package repository or ingesting from a VNet database. Have the network owner confirm the network routes to every target that workload touches before the gateway is configured. We'd keep the classic cluster running until a serverless run has proved DNS resolution and firewall behaviour, since your existing routes, DNS and firewall rules are what decide whether the target is reachable.
Questions people ask #
What is Private Network Gateway in Databricks? #
It's a Databricks-managed gateway that connects serverless compute to resources in your own network through a single network-level setup. You configure one connection, and serverless can then reach what your network can already reach, including connected on-premises environments.
Is Private Network Gateway generally available? #
Databricks' 14 October 2026 announcement says it is available in Public Preview on Azure. The 14 October 2026 announcement says it is in Private Preview on AWS with Google Cloud support in development.
Does Private Network Gateway cost anything? #
No source states how the gateway is billed, and no price has been published for it.
Does it replace Private Link? #
The gateway sits alongside Private Link. Databricks presents it together with expanded Private Link support for Lakebase and account-level services.