ADA-C01 Question 71
Single answerConfigure an Identity Provider (IdP) for SnowflakeAn enterprise is integrating Snowflake with Microsoft Entra ID (Azure AD) so users can sign in with SSO. The security team requires that only users who authenticate through the corporate IdP can access Snowflake, and administrators want to avoid disrupting service accounts that use key-pair authentication. During testing, some users can still sign in with username and password directly to Snowflake. Which configuration change should the Snowflake administrator make to meet the requirement with the least operational impact?
- A
Set the account parameter SSO_LOGIN_PAGE to TRUE so all users are redirected to the IdP sign-in page.
- B
Alter the users who should use SSO and set their PASSWORD property to NULL, while leaving service accounts unchanged.
- C
Create a network policy that only allows connections from the IdP IP addresses so direct Snowflake logins are blocked.
- D
Configure SCIM provisioning from Entra ID so passwords are no longer managed in Snowflake.
Show answer and explanation
Correct answer: B
Explanation
To enforce SSO for human users in Snowflake, administrators typically federate the account with a supported SAML 2.0 IdP and then remove Snowflake-managed passwords for those users by setting PASSWORD = NULL. This prevents direct password authentication to Snowflake while allowing federated login through the IdP. Service accounts that use key-pair authentication should generally be left as non-federated users, since key-pair auth is independent of Snowflake passwords and commonly used for automation. By contrast, login page preferences do not enforce authentication method, network policies control source network access rather than identity method, and SCIM handles provisioning rather than authentication enforcement. This aligns with Snowflake best practices for federated authentication and user management described in Snowflake documentation for SSO/federation and user administration.
- A. Incorrect.
Incorrect. Configuring the account to present or prefer the SSO login page improves the sign-in experience, but it does not by itself prevent users from authenticating with a Snowflake-managed password if one is still set on the user object. Users may still be able to access alternate login paths or use clients that authenticate directly. This option addresses usability, not enforcement.
- B. Correct.
Correct. In Snowflake, if a user is intended to authenticate exclusively through a federated IdP, setting the user's PASSWORD property to NULL prevents password-based sign-in to Snowflake for that user. This is the standard way to enforce federated authentication while preserving non-password authentication methods such as key-pair authentication for service accounts that should remain unaffected. It meets the requirement with minimal impact because only the interactive SSO users are changed.
- C. Incorrect.
Incorrect. Network policies restrict allowed client source IP addresses reaching Snowflake, but they do not distinguish between authentication methods. The IdP does not authenticate to Snowflake on behalf of users from a special source IP that can be used to block direct password logins selectively. This is a common misconception that confuses network control with identity enforcement.
- D. Incorrect.
Incorrect. SCIM provisioning automates lifecycle management tasks such as creating, updating, and deprovisioning users and groups, but it does not control whether Snowflake-managed passwords remain valid for authentication. A provisioned user can still have a Snowflake password unless it is removed or otherwise managed accordingly.