Network Connectivity Glossary
This page defines the terms used across Atlan's private connectivity guides, such as the AWS and Azure private network link guides for Snowflake. It also covers the identity terms used by API-based connectors such as Microsoft Power BI.
| Term | What it means |
|---|---|
| Endpoint (private endpoint) | The "plug" - a private network address inside Atlan's network that forwards traffic to your Snowflake service. Atlan creates and owns it. |
| Endpoint service / Private Link service | The "socket" - the thing Snowflake exposes for private connections. Snowflake creates it when Private Link is enabled on your account. |
privatelink-vpce-id | The AWS name of the socket (VPCE = "VPC endpoint"). Only exists for AWS-hosted Snowflake. If your config output has no vpce-id, your Snowflake is on Azure - use the Azure guide. |
privatelink-pls-id | The Azure name of the socket (PLS = "Private Link service"). Only exists for Azure-hosted Snowflake. |
| Resource ID | Azure's full path-like name for any object (starts /subscriptions/…). Atlan sends you the Resource ID of the endpoint it created so you can approve exactly that one. |
| Azure token | A short-lived proof-of-identity string Atlan generates alongside the endpoint. Snowflake requires it in the approval command so only the endpoint's real owner can be authorized. It expires - if approval fails with a token error, ask Atlan support for a fresh one. |
| OCSP URL | The address used to check that TLS certificates haven't been revoked. It must also resolve over the private path, which is why the guides collect it. You never configure it yourself - Atlan does. |
| Regionless vs regional URL | Snowflake accounts have two hostname styles (org-account.privatelink… vs account.region.privatelink…). Share both if present; Atlan tells you which to use in the crawler. |
| Network policy / network rule | Snowflake's firewall: a list of IPs, CIDR ranges, or endpoint IDs allowed to connect. If you use one, it needs an Atlan entry - see the private network link guides. |
| NAT IP | The fixed public IP address your Atlan tenant's outbound traffic appears from when not using a private link. |
| CIDR range | Shorthand for a block of IP addresses, for example 10.20.0.0/17 = all addresses from 10.20.0.0 to 10.20.127.255. Allowlist the whole published block - a partial range causes intermittent failures. |
| Workspace URL | The hostname you open in a browser - your-ws.cloud.databricks.com (AWS) or adb-1234567890123456.7.azuredatabricks.net (Azure). This is also what you enter as the host in the Atlan connection: the URL doesn't change when you move to Private Link - only where it resolves to. |
| Workspace ID | The long number identifying a Databricks workspace - after ?o= in the URL, or in the Account Console. Atlan asks for it to disambiguate multi-workspace setups. |
| VPC endpoint service name | The AWS name of the socket, in the form com.amazonaws.vpce.<region>.vpce-svc-xxxxxxxxxxxxxxxxx. Found in the Databricks Account Console under Cloud resources → Network. Only exists for AWS-hosted workspaces. |
| VPCE ID | The ID of the endpoint (plug) Atlan creates, like vpce-0a1b2c3d4e5f6a7b8. You register this ID in your Databricks Account Console when approving the connection. |
| Private Access Settings (PAS) | The Databricks object that turns front-end Private Link on for a workspace and decides whether public access stays open alongside it. Owned by your Databricks account admin. |
databricks_ui_api | The Azure "group ID" (sub-target) Atlan's private endpoint connects to - it means "the workspace's web UI and REST API front end." |
| Private DNS mapping | The record inside Atlan's network that makes your workspace URL resolve to the private endpoint (a private hosted zone on AWS; the privatelink.azuredatabricks.net zone on Azure). Atlan creates and maintains it - one mapping per workspace hostname. |
| IP access list | Databricks' IP firewall for a workspace (Workspace settings → Security → IP access lists). If enabled, it must permit whatever path Atlan arrives on - public egress IPs or the private range. |
| NSG (network security group) | Azure's subnet-level firewall. The NSG in front of your Private Link path must permit Atlan's tenant CIDR range on port 443 - approval alone doesn't open it. |
| Serverless egress IPs | The outbound addresses used when Databricks calls out to external services (like Atlan's MCP endpoint). These belong to Databricks' serverless compute plane - not your cluster's NAT IP - and your team may need Databricks support to enumerate them. |
| App registration (Power BI) | The identity you create in Microsoft Entra ID for Atlan, like a machine user account. Has a client ID and a secret. |
| Service principal (SP) | The runtime object created from an app registration; in the Azure portal it appears as an Enterprise Application. This is what you add to security groups and Power BI workspaces. |
| Client secret - Value vs Secret ID | The Value is the password (shown once at creation); the Secret ID is just a label. Pasting the Secret ID into Atlan is a common Power BI setup error (AADSTS7000215). |
| Tenant settings (Power BI) | Power BI admin-portal switches that decide which API families service principals may call. The Power BI connector needs four, each scoped to a security group. |
| Admin APIs vs Fabric public APIs | Two separate Power BI API families with separate tenant settings. Admin (read-only) APIs list everything tenant-wide; Fabric public APIs read workspace-scoped detail (report pages, dataset parameters). Neither setting includes the other. |
| Scanner API mode | A Power BI crawler toggle that reads through tenant-level admin APIs instead of workspace membership. Less setup, less detail (no report pages, degraded measure lineage). |