ADA-C01 Question 125
Single answerEnable, configure, and manage SCIM integrationA company uses Microsoft Entra ID to provision users and roles into Snowflake. The security team wants automated lifecycle management, but they also require that no human administrator passwords be embedded in the provisioning configuration. A Snowflake administrator has already created a dedicated custom role for SCIM and granted it the minimum required privileges. What is the most appropriate next step to enable secure SCIM provisioning from Entra ID to Snowflake?
- A
Create a security integration of TYPE = SCIM with SCIM_CLIENT = AZURE, generate an OAuth access token for the dedicated SCIM role, and use the Snowflake SCIM endpoint and token in Entra ID provisioning.
- B
Create a SAML2 security integration for Entra ID and reuse the SAML metadata URL and SSO URL as the SCIM provisioning endpoint.
- C
Configure Entra ID to connect with Snowflake using a username and password for a SECURITYADMIN user, because SCIM requires account-level administrator credentials.
- D
Create a network policy that allows Entra ID IP addresses, then Entra ID can provision users and roles without any Snowflake security integration or token.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure a Snowflake SCIM security integration specifically for Microsoft Entra ID by using TYPE = SCIM and SCIM_CLIENT = AZURE, then use a token-based authentication method tied to a dedicated SCIM provisioning role. This is the recommended pattern for enabling secure automated user and role lifecycle management without storing a human administrator password in the identity provider. In practice, administrators create a least-privilege custom role for SCIM operations, grant the required privileges, create the SCIM security integration, generate the access token, and then supply the Snowflake SCIM endpoint and bearer token to Entra ID provisioning. Snowflake documentation distinguishes SCIM integrations from SAML integrations: SAML is for authentication, while SCIM is for provisioning. Best practice also includes avoiding overly broad admin credentials and using network policies only as supplemental controls, not as a substitute for SCIM integration configuration.
- A. Correct.
Correct. For Microsoft Entra ID SCIM provisioning, Snowflake supports creating a SCIM security integration with SCIM_CLIENT = AZURE. The typical secure setup is to create a dedicated role with the required SCIM management privileges, then generate an OAuth access token associated with that role for use by the identity provider. This avoids embedding a human administrator password and aligns with least-privilege and service-account-style provisioning practices. Entra ID then uses the Snowflake SCIM base URL and bearer token to provision and deprovision users and roles.
- B. Incorrect.
Incorrect. SAML and SCIM serve different purposes. A SAML2 security integration is used for federated authentication/SSO, while SCIM is used for identity lifecycle management such as provisioning users and groups/roles. Reusing SAML metadata or SSO URLs for SCIM provisioning is a common misconception because both are often configured with the same identity provider, but they are separate integrations with different endpoints and purposes.
- C. Incorrect.
Incorrect. Using a username and password for a highly privileged human admin account is not the recommended way to configure Snowflake SCIM provisioning. Snowflake supports token-based authentication for SCIM integrations, which is more secure and auditable. The scenario explicitly requires avoiding embedded human administrator passwords. Also, least privilege should be used instead of broad administrator credentials.
- D. Incorrect.
Incorrect. A network policy can restrict which client IP addresses may connect to Snowflake, but it does not establish SCIM authentication or authorization by itself. Entra ID still needs a properly configured Snowflake SCIM security integration and valid authentication token to call the SCIM API. Network controls may be an additional hardening step, but they are not sufficient to enable provisioning.