ADA-C01 Question 7
Single answerIdentify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN)A company uses one Snowflake organization with several production and non-production accounts. The security team wants to reduce risk from highly privileged roles while still allowing central administration. They decide that organization-level tasks such as creating new accounts and viewing organization-wide usage should be performed by a very small central team, while day-to-day administration inside each account should be handled locally. Which approach BEST aligns with Snowflake best practices for using ORGADMIN (noting that this role is being replaced by GLOBALORGADMIN) and ACCOUNTADMIN?
- A
Grant ACCOUNTADMIN in every account to the central team, and avoid using ORGADMIN/GLOBALORGADMIN because account-level roles can perform the same organization-wide tasks.
- B
Use ORGADMIN/GLOBALORGADMIN only for organization-level responsibilities such as managing accounts in the organization, and limit ACCOUNTADMIN to account-specific administration within each account; assign both roles only to a minimal number of trusted administrators.
- C
Grant ORGADMIN/GLOBALORGADMIN to all account administrators so they can troubleshoot both account-level and organization-level issues without role switching.
- D
Use ACCOUNTADMIN for creating new accounts in the organization, and reserve ORGADMIN/GLOBALORGADMIN mainly for warehouse, database, and user management inside each account.
Show answer and explanation
Correct answer: B
Explanation
The key distinction is scope. ACCOUNTADMIN is the top administrative role inside a single Snowflake account and is intended for account-level tasks, while ORGADMIN is the organization-level administrative role, with Snowflake indicating that ORGADMIN will be replaced by GLOBALORGADMIN. In practice, organization-level tasks such as creating or managing accounts and reviewing organization-wide information belong to ORGADMIN/GLOBALORGADMIN, whereas local administration inside each account should remain with ACCOUNTADMIN or delegated custom roles.
From a security and governance perspective, Snowflake best practices emphasize least privilege, separation of duties, and minimizing assignment of highly privileged system roles. A common real-world pattern is to keep ORGADMIN/GLOBALORGADMIN with a very small central platform team and reserve ACCOUNTADMIN for a small number of trusted administrators per account, delegating routine operational tasks through lower-privilege custom roles where possible.
This question tests whether the candidate can correctly separate organization-level and account-level responsibilities and apply privilege-minimization best practices rather than simply identifying role names.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest privileged role within a single Snowflake account, but it does not replace organization-level administration. Organization-level tasks such as managing accounts in the organization are handled by ORGADMIN, which Snowflake indicates is being replaced by GLOBALORGADMIN. This option also violates least-privilege guidance by broadly granting ACCOUNTADMIN to a central team across all accounts.
- B. Correct.
Correct. This reflects Snowflake best practice: use ORGADMIN/GLOBALORGADMIN for organization-scoped responsibilities, such as creating and managing accounts in the organization and viewing organization-level information, while ACCOUNTADMIN should be used for administration within an individual account. Both roles are highly privileged and should be tightly controlled and granted to as few trusted users as possible.
- C. Incorrect.
Incorrect. Granting ORGADMIN/GLOBALORGADMIN broadly to all account administrators expands privilege unnecessarily and conflicts with separation-of-duties and least-privilege principles. Account administrators usually need account-scoped privileges, not organization-wide authority.
- D. Incorrect.
Incorrect. This reverses the intended scope of the roles. ACCOUNTADMIN is for account-level administration, while ORGADMIN/GLOBALORGADMIN is for organization-level administration. Warehouse, database, role, and user management inside an account are not the primary purpose of ORGADMIN/GLOBALORGADMIN.