COF-C03 Question 150
Single answerFederated AuthenticationA company uses Microsoft Entra ID as its corporate identity provider and wants employees to sign in to Snowflake with their existing corporate credentials. Security requires that user authentication be handled by the external identity provider, while Snowflake still controls role-based authorization after login. The Snowflake administrator also wants to avoid creating and managing separate Snowflake passwords for these users. Which configuration best meets these requirements?
- A
Configure Snowflake federated authentication with SAML 2.0 using Microsoft Entra ID as the identity provider, and set the users to authenticate through the IdP
- B
Enable key-pair authentication for all users so Microsoft Entra ID can validate the private keys during login
- C
Create local Snowflake passwords for all users and synchronize those passwords from Microsoft Entra ID on a scheduled basis
- D
Use network policies with allowed IP ranges so Snowflake can trust users connecting from the corporate network without separate authentication
Show answer and explanation
Correct answer: A
Explanation
The best solution is to configure Snowflake federated authentication using SAML 2.0 with Microsoft Entra ID as the external identity provider. In Snowflake, federated authentication delegates user authentication to the IdP, allowing users to sign in with existing enterprise credentials and eliminating the need for separate Snowflake passwords. Snowflake then performs authorization internally by assigning roles and privileges after the user is authenticated. This separation of authentication and authorization is a key concept for SnowPro Core. Snowflake documentation on federated authentication and SSO describes SAML 2.0-based integration with external IdPs, while key-pair authentication is documented separately for non-interactive or client-based authentication scenarios. Network policies are an additional security control, but they are not an authentication mechanism.
- A. Correct.
Correct. Snowflake supports federated authentication through SAML 2.0 with a supported identity provider such as Microsoft Entra ID. In this model, the IdP authenticates the user, which satisfies the requirement to use existing corporate credentials and avoid separate Snowflake passwords. After successful authentication, Snowflake still applies its own authorization model, including roles and privileges.
- B. Incorrect.
Incorrect. Key-pair authentication is primarily used for programmatic access and client authentication, not for browser-based workforce single sign-on through a corporate identity provider. Microsoft Entra ID does not validate Snowflake private keys as part of Snowflake federated SSO. This option confuses client key-based authentication with federated user authentication.
- C. Incorrect.
Incorrect. Synchronizing local Snowflake passwords would not meet the requirement that authentication be handled by the external identity provider. It also increases operational overhead and weakens the single sign-on objective because Snowflake would still be maintaining password-based authentication locally.
- D. Incorrect.
Incorrect. Network policies restrict where users can connect from, but they do not replace authentication. Allowing connections from corporate IP ranges does not authenticate a user's identity or provide single sign-on with corporate credentials. This option confuses network-level access control with identity federation.