See it as a diagram
Everything below, as a diagram you can edit. Describe yours and see it in seconds.
No account needed · Editable canvas, not a picture
Two planes, one boundary, and most diagrams miss it
The control plane holds the web application, notebooks, the job scheduler, the cluster manager, and the query history. It runs in a Databricks-managed Azure subscription in the workspace region. The compute plane holds the clusters themselves, driver and workers, and it runs in your subscription.
With VNet injection the compute plane lands in a virtual network you own, using two delegated subnets, conventionally called the host subnet and the container subnet, with a network security group Databricks manages. Without it, the compute plane still runs in your subscription but in a Databricks-managed virtual network you do not control. Which of the two you are running is the single most important fact on the diagram, so draw the boundary as the top-level split and label it.
Once the boundary is drawn, the connectivity story becomes drawable: the front end path is users and BI tools reaching the workspace, the back end path is clusters reaching the control plane. Private Link can secure either or both, and teams routinely secure one and forget the other. Two labelled edges make that visible in a way a paragraph does not.
Storage, and which Azure icon is the correct one
ADLS Gen2 is a storage account with the hierarchical namespace enabled, not a separate product. That is why the official Azure set ships a Data Lake Storage Gen1 mark and no Gen2 equivalent: unzip the current archive and you find azure-data-lake-storage-gen1 next to azure-storage-accounts, with nothing in between. The correct icon for a Gen2 account is therefore the Storage Accounts mark, and the fact that the account has a hierarchical namespace belongs on the label. The Terraform catalog here makes the same call in code, mapping azurerm_storage_account to the Storage Accounts icon and picking out is_hns_enabled as an attribute worth showing on the node, which is the piece of information the Gen1 mark would otherwise be standing in for.
Inside the storage account, draw containers rather than folders: bronze, silver, gold, or raw, enriched, curated. Containers are the unit that external locations and access control point at, so they are the right granularity. Add a separate node for the DBFS root storage account created with the workspace, with a note that it does not hold production data, because that question comes up in every review.
Checkpoint and schema locations for Structured Streaming deserve a mention on the container that holds them. They are the state that makes a stream restartable, and losing them is a real incident, which makes them worth a label rather than a footnote.
Unity Catalog changes the shape of the picture
Unity Catalog introduces a metastore per region, above workspaces, holding catalogs, schemas, and tables. Draw the metastore outside the workspace boundary, because that is where it lives, and draw the workspaces attached to it. A diagram that nests the metastore inside one workspace implies an isolation that does not exist.
The access chain is the part worth drawing carefully: a cluster asks for a table, the table resolves to an external location, the external location is backed by a storage credential, and the storage credential is an Azure managed identity provided by an Access Connector for Azure Databricks that has Storage Blob Data Contributor on the container. That is a five-hop path, it is the path that breaks, and drawing it saves an afternoon of debugging the next time it does. The icon for the connector is the Managed Identities mark rather than anything Databricks-branded, because that is what the resource is; the repository parser makes the same substitution for azurerm_databricks_access_connector.
Catalogs mapped to environments, one per dev, staging, and production, are worth showing as zones if that is your convention. It is the fastest way to answer whether a production job can read a development table.
The rest of the platform, and the icons for it
Orchestration is Databricks Workflows, Azure Data Factory, or both, and if it is both the diagram should say which one owns which pipelines. Streaming ingestion arrives from Event Hubs or Kafka into Delta tables. Secrets come from Key Vault backed secret scopes. Monitoring goes to Log Analytics and Azure Monitor. Consumption is Power BI, and increasingly a SQL warehouse rather than an all-purpose cluster, which is worth distinguishing because the cost and concurrency behaviour differ.
On icons: the Azure set has a distinct Azure Databricks service icon, and the Databricks company mark is a different image. Use the Azure service icon when the box is the Azure resource, and keep the vendor mark for a legend or a tooling row. Datadef ships both, inside 624 Azure marks and a 32-file data tool set that covers Spark, Kafka, Flink, Snowflake, dbt, Airflow, Dagster and the rest of what sits around a lakehouse.
The grants are the part to leave out. Unity Catalog grants, workspace permissions, group memberships and service principal roles are classified as wiring in the Terraform catalog and never become nodes, which on a real Databricks stack removes more resources than it keeps. They are counted in a note instead, and the full list lands in the generated architecture document rather than on the canvas.
Describe the platform in a sentence and the canvas comes back with the planes as zones and the real icons in them. Export to PNG or JPEG, or publish it as a live embed in the platform wiki. Single files are on pages like the Azure Databricks icon.
FAQ
What is the difference between the Databricks control plane and compute plane on a diagram?
Which Azure icon should I use for ADLS Gen2?
Where does Unity Catalog sit in an Azure Databricks diagram?
Should the diagram show private endpoints?
Is the Azure Databricks icon the same as the Databricks logo?