ADA-C01 Question 73
Single answerConfigure, use, and manage federated authentication with SnowflakeA company is integrating Snowflake with Microsoft Entra ID (Azure AD) for SSO. Security requires that employees authenticate through the corporate IdP, but service accounts used by ETL tools must continue to authenticate with key-pair authentication and must not be redirected to the IdP. During testing, administrators notice that after setting the account-level SAML integration, some non-human users can no longer connect as expected. Which action should the Snowflake administrator take to meet both requirements with the least operational overhead?
- A
Create a separate Snowflake account for service users so federated authentication can remain enabled for all users in the primary account.
- B
Set the account parameter ALLOW_ID_TOKEN to FALSE for service users so they bypass SAML and continue using key-pair authentication.
- C
Configure the SAML2 security integration at the account level, and for each service user set the user-level DISABLE_SAML_LOGIN parameter to TRUE.
- D
Configure a network policy that exempts ETL tool IP addresses from SAML authentication while keeping SSO for employee IP ranges.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to configure SAML federated authentication at the Snowflake account level for workforce SSO and then exempt only the non-human accounts that should continue using key-pair authentication by setting DISABLE_SAML_LOGIN = TRUE on those users. This aligns with Snowflake best practices for mixed authentication models, where interactive users often use SSO and service users use non-interactive authentication methods.
Why this matters operationally: service accounts commonly cannot complete browser-based SAML flows, so forcing them through federated login breaks automation. Snowflake supports this mixed model without requiring a separate account. A separate account would increase administrative complexity and is usually unnecessary unless there are broader isolation requirements.
Relevant Snowflake documentation and best practices include Snowflake guidance for configuring federated authentication using SAML2 security integrations, as well as user-level controls that disable SAML login for specific accounts. Administrators should also ensure service users are configured with appropriate authentication methods such as key-pair authentication and least-privilege role assignments.
- A. Incorrect.
Incorrect. Creating a separate Snowflake account could work technically, but it adds significant operational overhead for governance, replication of roles/objects, monitoring, and lifecycle management. Snowflake provides a simpler built-in control at the user level for excluding specific users from SAML-based login requirements, so this is not the least-overhead solution.
- B. Incorrect.
Incorrect. ALLOW_ID_TOKEN is not the control used to exempt specific Snowflake users from SAML-based federated authentication in this scenario. The requirement is to allow non-human users to continue using non-SSO authentication methods such as key-pair authentication while employees use SSO. The relevant user-level setting is DISABLE_SAML_LOGIN.
- C. Correct.
Correct. In Snowflake, SAML federated authentication is typically configured through a SAML2 security integration at the account level for workforce users. If certain users, such as ETL or service accounts, should not use SAML login, administrators can set DISABLE_SAML_LOGIN = TRUE on those individual users. This allows those accounts to continue authenticating with supported non-interactive methods such as key-pair authentication, while human users still use the corporate IdP.
- D. Incorrect.
Incorrect. Network policies control allowed client IP addresses, not whether a user is redirected to a SAML IdP. They are useful for restricting access by source network but do not selectively bypass federated authentication based on IP ranges. This option confuses access control with authentication method selection.