COF-C03 Question 152
Single answerSingle Sign-on (SSO)A company uses Microsoft Entra ID as its corporate identity provider and wants all analysts to sign in to Snowflake with Single Sign-on (SSO) from the Snowsight URL. The security team also wants to prevent users from being redirected to a different identity provider if they type only their Snowflake username on the login page. Which configuration should the Snowflake administrator implement to meet this requirement?
- A
Configure a SAML2 security integration for Entra ID and set the account-level SAML_IDENTITY_PROVIDER object so Snowflake uses that IdP as the default for the account.
- B
Create an OAuth security integration for Entra ID and require users to authenticate with OAuth instead of SAML when accessing Snowsight.
- C
Configure SCIM provisioning for Entra ID so Snowflake can infer the correct identity provider during login.
- D
Create separate network policies for analysts so Snowflake can route each login request to the correct SSO provider based on client IP.
Show answer and explanation
Correct answer: A
Explanation
This scenario focuses on practical SSO configuration in Snowflake. For enterprise user authentication with an external IdP such as Microsoft Entra ID, Snowflake uses federated authentication through a SAML2 security integration. When users initiate login from the Snowflake-provided sign-in experience, administrators can configure the account-level SAML_IDENTITY_PROVIDER object so Snowflake has a default IdP for the account. That helps avoid ambiguous IdP selection and supports a consistent user experience. By contrast, SCIM handles lifecycle provisioning, not authentication, and network policies govern source IP access, not SSO routing. OAuth is a valid Snowflake capability, but it is not the standard answer for browser-based workforce SSO into Snowsight in this context. These behaviors align with Snowflake documentation on federated authentication, SAML security integrations, and account-level SSO settings.
- A. Correct.
Correct. For federated authentication to Snowflake with an external identity provider such as Microsoft Entra ID, the administrator configures a SAML2 security integration. To ensure Snowflake knows which identity provider to use when a user starts from the Snowflake sign-in page without explicitly selecting an IdP, the account can be configured with the account-level SAML_IDENTITY_PROVIDER object. This establishes the default identity provider for the account and supports the required SSO behavior from Snowsight.
- B. Incorrect.
Incorrect. OAuth integrations in Snowflake are used for delegated authorization patterns and application access, not as the standard mechanism for workforce SSO into Snowsight. For user SSO with enterprise identity providers, Snowflake commonly uses SAML 2.0 federation rather than replacing interactive Snowsight login with OAuth.
- C. Incorrect.
Incorrect. SCIM is used to provision and deprovision users and roles between an identity provider and Snowflake. It does not control the interactive authentication flow or determine which identity provider Snowflake should redirect users to during SSO login.
- D. Incorrect.
Incorrect. Network policies restrict access based on allowed or blocked IP addresses. They do not participate in identity provider selection or SSO routing logic. A candidate might choose this option because network controls are often part of security architecture, but they do not solve the login redirection requirement in this scenario.