Dual resource group VNet architecture for Azure Databricks PoC with isolated subnets for compute, private endpoints, and management. Databricks Workspace in rg-databricks connects securely to Storage Account and Key Vault via private endpoints in rg-cetin-poc, eliminating public internet exposure. Private DNS zones resolve blob.core.windows.net and vaultcore.azure.net internally, while management VMs access resources through NSG-controlled endpoints. Unity Catalog integrates with Databricks for governed data access, with Azure Monitor and Azure AD providing observability and identity management. Fork this diagram to customize subnet ranges, add additional private endpoints, or extend the architecture for production multi-region deployments.