ADA-C01 Question 121
Select 2Analyze SCIM and its use cases as they relate to SnowflakeA company uses Microsoft Entra ID as its identity provider and has enabled SAML-based single sign-on for Snowflake. The security team wants user and role administration in Snowflake to be driven automatically from the identity provider so that when employees join, change departments, or leave the company, access in Snowflake is updated with minimal manual effort. The Snowflake administrator is evaluating SCIM. Which TWO outcomes should the administrator expect when implementing SCIM integration for Snowflake?
- A
User lifecycle changes in the identity provider, such as provisioning and deprovisioning, can be synchronized to Snowflake automatically.
- B
Group information from the identity provider can be synchronized so that access management can be aligned with centrally managed groups.
- C
SCIM replaces the need for SAML because it provides both user provisioning and interactive user authentication for Snowflake.
- D
SCIM automatically synchronizes all object privileges, such as table grants and warehouse usage, directly from the identity provider into Snowflake.
- E
SCIM requires each Snowflake user to authenticate with a personal access token instead of federated SSO credentials.
Show answer and explanation
Correct answers: A, B
Explanation
The best answers are 1 and 2. In Snowflake, SCIM is used to automate identity provisioning and lifecycle management from an external identity provider such as Microsoft Entra ID or Okta. Typical use cases include automatically creating users, updating user attributes, disabling users during offboarding, and synchronizing groups to support centralized identity administration. However, SCIM does not perform interactive authentication; that is handled separately through federation technologies such as SAML. SCIM also does not directly assign Snowflake object privileges from the identity provider. Instead, administrators use Snowflake roles and grants for privilege management, often in combination with IdP-synchronized groups and role assignment strategies. This aligns with Snowflake best practices of separating authentication, provisioning, and authorization concerns.
- A. Correct.
Correct. SCIM is designed for identity lifecycle management and provisioning. In Snowflake, SCIM can automate creation, update, and deactivation of users based on changes in the external identity provider. This is a primary use case when organizations want HR- or IdP-driven onboarding and offboarding instead of manual CREATE USER / ALTER USER administration.
- B. Correct.
Correct. SCIM can synchronize groups from supported identity providers to Snowflake, which helps align Snowflake role assignment processes with centrally managed identity groups. This is especially useful when an organization wants to reduce manual user administration and keep role membership changes tied to enterprise identity governance processes.
- C. Incorrect.
Incorrect. This confuses authentication with provisioning. SAML is used for federated authentication and SSO, while SCIM is used for identity provisioning and lifecycle synchronization. Implementing SCIM does not eliminate the need for an authentication mechanism such as SAML for interactive login.
- D. Incorrect.
Incorrect. SCIM does not manage Snowflake object-level privileges such as GRANT SELECT on tables or GRANT USAGE on warehouses. Those privileges remain controlled within Snowflake through roles and grants. A common misconception is that IdP group sync directly pushes object grants, but in practice administrators still map access through Snowflake roles and role grants.
- E. Incorrect.
Incorrect. SCIM does not change how users authenticate to Snowflake. It is an API-based provisioning standard used between the identity provider and Snowflake for account administration tasks. End users can continue to authenticate through the configured method, such as SAML SSO.