ADA-C01 Question 122
Single answerAnalyze SCIM and its use cases as they relate to SnowflakeA company uses Microsoft Entra ID as its corporate identity provider and has enabled SSO for Snowflake. The security team wants user lifecycle events in Entra ID to automatically control access to Snowflake with minimal manual administration. Their requirements are: new employees should be provisioned into Snowflake automatically, users removed from the company should no longer be able to access Snowflake, and role assignment should remain under Snowflake administrator control rather than being driven by the identity provider. Which approach best meets these requirements?
- A
Configure SCIM provisioning from Entra ID to Snowflake for user lifecycle management, and continue managing Snowflake role grants separately within Snowflake.
- B
Use SAML SSO only, because SAML assertions can automatically create and delete Snowflake users and manage their role grants during login.
- C
Configure SCIM so Entra ID provisions Snowflake users and directly manages Snowflake object privileges such as warehouse USAGE and table SELECT grants.
- D
Rely on Just-in-Time (JIT) user provisioning through SSO so that disabling a user in Entra ID automatically drops the Snowflake user and revokes all access.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SCIM for automated user provisioning and deprovisioning while continuing to manage Snowflake authorization within Snowflake. In Snowflake, SCIM complements SSO: SSO/SAML or OIDC addresses authentication, while SCIM addresses identity lifecycle management. This makes SCIM the appropriate solution when an organization wants new users created automatically and former employees prevented from accessing Snowflake without relying on manual user administration. A key distinction candidates should understand is that SCIM does not replace Snowflake's role-based access control model for object privileges. Best practice is to separate authentication, provisioning, and authorization concerns: use the IdP plus SCIM for identity lifecycle automation, and use Snowflake roles/grants for least-privilege access design. See Snowflake documentation on SCIM user and group provisioning and on federated authentication/SSO for the division of responsibilities between these features.
- A. Correct.
Correct. SCIM is designed for automated identity lifecycle management, including provisioning and deprovisioning users between an identity provider and Snowflake. This aligns with the requirement to automatically create users and prevent access for users removed from the company. At the same time, Snowflake role grants and object privilege management can remain under Snowflake administrative control, which is a common pattern when organizations want centralized identity lifecycle automation without delegating authorization design to the IdP.
- B. Incorrect.
Incorrect. SAML SSO handles authentication, not full lifecycle provisioning. While SSO can authenticate users, it does not by itself provide SCIM-style create, update, and deprovision workflows for Snowflake users. It also does not serve as the mechanism for deleting users or managing ongoing role grants in Snowflake. This option reflects a common misconception that SSO alone covers identity lifecycle management.
- C. Incorrect.
Incorrect. SCIM is used for identity provisioning data such as users and, depending on integration design, group-related identity synchronization. It does not directly manage Snowflake object privileges like USAGE on warehouses or SELECT on tables. Those are authorization tasks handled through Snowflake roles and grants. This distractor confuses identity provisioning with database authorization administration.
- D. Incorrect.
Incorrect. JIT provisioning can create users at login in some identity architectures, but it is not the right answer for full lifecycle control in Snowflake. More importantly, disabling a user in the IdP does not mean Snowflake will automatically drop the user object through JIT. Deprovisioning and lifecycle synchronization are the primary use cases for SCIM, not JIT. This option also overstates what happens when a user is disabled.