You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/snowflake-provisioning-tutorial.md
+47-34Lines changed: 47 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,9 @@ This tutorial demonstrates the steps that you perform in Snowflake and Azure Act
21
21
> This connector is currently in public preview. For information about terms of use, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
22
22
23
23
## Capabilities supported
24
+
24
25
> [!div class="checklist"]
26
+
>
25
27
> * Create users in Snowflake
26
28
> * Remove users in Snowflake when they don't require access anymore
27
29
> * Keep user attributes synchronized between Azure AD and Snowflake
@@ -38,6 +40,7 @@ The scenario outlined in this tutorial assumes that you already have the followi
38
40
* A user account in Snowflake with admin permissions
39
41
40
42
## Step 1: Plan your provisioning deployment
43
+
41
44
1. Learn about [how the provisioning service works](../app-provisioning/user-provisioning.md).
42
45
1. Determine who will be in [scope for provisioning](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
43
46
1. Determine what data to [map between Azure AD and Snowflake](../app-provisioning/customize-application-attributes.md).
@@ -46,76 +49,83 @@ The scenario outlined in this tutorial assumes that you already have the followi
46
49
47
50
Before you configure Snowflake for automatic user provisioning with Azure AD, you need to enable System for Cross-domain Identity Management (SCIM) provisioning on Snowflake.
48
51
49
-
1. Sign in to your Snowflake admin console. Enter the following query in the highlighted worksheet, and then select **Run**.
52
+
1. Sign in to Snowflake as an administrator and execute the following from either the Snowflake worksheet interface or SnowSQL.
50
53
51
-
52
-
53
54
```
54
55
use role accountadmin;
55
56
56
-
create or replace role aad_provisioner;
57
-
grant create user on account to aad_provisioner;
58
-
grant create role on account to aad_provisioner;
57
+
create role if not exists aad_provisioner;
58
+
grant create user on account to role aad_provisioner;
59
+
grant create role on account to role aad_provisioner;
59
60
grant role aad_provisioner to role accountadmin;
60
-
create or replace security integration aad_provisioning type=scim scim_client=azure run_as_role='AAD_PROVISIONER';
1. A SCIM access token is generated for your Snowflake tenant. To retrieve it, select the link highlighted in the following screenshot.
68
+
2. Use the ACCOUNTADMIN role.
69
+
70
+
71
+
72
+
3. Create the custom role AAD_PROVISIONER. All users and roles in Snowflake created by Azure AD will be owned by the scoped down AAD_PROVISIONER role.
66
73
67
-
74
+
68
75
69
-
1. Copy the generated token value and select **Done**. This value is entered in the **Secret Token** box on the **Provisioning** tab of your Snowflake application in the Azure portal.
76
+
4. Let the ACCOUNTADMIN role create the security integration using the AAD_PROVISIONER custom role.
70
77
71
-
78
+
79
+
80
+
5. Create and copy the authorization token to the clipboard and store securely for later use. Use this token for each SCIM REST API request and place it in the request header. The access token expires after six months and a new access token can be generated with this statement.
81
+
82
+
72
83
73
84
## Step 3: Add Snowflake from the Azure AD application gallery
74
85
75
-
Add Snowflake from the Azure AD application gallery to start managing provisioning to Snowflake. If you previously set up Snowflake for single sign-on (SSO), you can use the same application. However, we recommend that you create a separate app when you're initially testing the integration. [Learn more about adding an application from the gallery](../manage-apps/add-application-portal.md).
86
+
Add Snowflake from the Azure AD application gallery to start managing provisioning to Snowflake. If you previously set up Snowflake for single sign-on (SSO), you can use the same application. However, we recommend that you create a separate app when you're initially testing the integration. [Learn more about adding an application from the gallery](../manage-apps/add-application-portal.md).
76
87
77
-
## Step 4: Define who will be in scope for provisioning
88
+
## Step 4: Define who will be in scope for provisioning
78
89
79
-
The Azure AD provisioning service allows you to scope who will be provisioned based on assignment to the application, or based on attributes of the user or group. If you choose to scope who will be provisioned to your app based on assignment, you can use the [steps to assign users and groups to the application](../manage-apps/assign-user-or-group-access-portal.md). If you choose to scope who will be provisioned based solely on attributes of the user or group, you can [use a scoping filter](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
90
+
The Azure AD provisioning service allows you to scope who will be provisioned based on assignment to the application, or based on attributes of the user or group. If you choose to scope who will be provisioned to your app based on assignment, you can use the [steps to assign users and groups to the application](../manage-apps/assign-user-or-group-access-portal.md). If you choose to scope who will be provisioned based solely on attributes of the user or group, you can [use a scoping filter](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
80
91
81
92
Keep these tips in mind:
82
93
83
-
* When you're assigning users and groups to Snowflake, you must select a role other than Default Access. Users with the Default Access role are excluded from provisioning and will be marked as not effectively entitled in the provisioning logs. If the only role available on the application is the Default Access role, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add more roles.
94
+
* When you're assigning users and groups to Snowflake, you must select a role other than Default Access. Users with the Default Access role are excluded from provisioning and will be marked as not effectively entitled in the provisioning logs. If the only role available on the application is the Default Access role, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add more roles.
84
95
85
96
* If you need additional roles, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add new roles.
86
97
87
-
88
-
## Step 5: Configure automatic user provisioning to Snowflake
98
+
## Step 5: Configure automatic user provisioning to Snowflake
89
99
90
100
This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and groups in Snowflake. You can base the configuration on user and group assignments in Azure AD.
91
101
92
102
To configure automatic user provisioning for Snowflake in Azure AD:
93
103
94
104
1. Sign in to the [Azure portal](https://portal.azure.com). Select **Enterprise applications** > **All applications**.
95
105
96
-
106
+
97
107
98
108
2. In the list of applications, select **Snowflake**.
99
109
100
-
110
+
101
111
102
112
3. Select the **Provisioning** tab.
103
113
104
-
114
+
105
115
106
116
4. Set **Provisioning Mode** to **Automatic**.
107
117
108
-
118
+
109
119
110
-
5. In the **Admin Credentials** section, enter the SCIM 2.0 base URL and authentication token that you retrieved earlier in the **Tenant URL** and **Secret Token** boxes, respectively.
120
+
5. In the **Admin Credentials** section, enter the SCIM 2.0 base URL and authentication token that you retrieved earlier in the **Tenant URL** and **Secret Token** boxes, respectively.
111
121
112
122
Select **Test Connection** to ensure that Azure AD can connect to Snowflake. If the connection fails, ensure that your Snowflake account has admin permissions and try again.
113
123
114
-
124
+
115
125
116
126
6. In the **Notification Email** box, enter the email address of a person or group who should receive the provisioning error notifications. Then select the **Send an email notification when a failure occurs** check box.
117
127
118
-
128
+
119
129
120
130
7. Select **Save**.
121
131
@@ -147,43 +157,46 @@ To configure automatic user provisioning for Snowflake in Azure AD:
147
157
148
158
13. To enable the Azure AD provisioning service for Snowflake, change **Provisioning Status** to **On** in the **Settings** section.
149
159
150
-
160
+
151
161
152
162
14. Define the users and groups that you want to provision to Snowflake by choosing the desired values in **Scope** in the **Settings** section.
153
163
154
164
If this option is not available, configure the required fields under **Admin Credentials**, select **Save**, and refresh the page.
155
165
156
-
166
+
157
167
158
168
15. When you're ready to provision, select **Save**.
159
169
160
-
170
+
161
171
162
172
This operation starts the initial synchronization of all users and groups defined in **Scope** in the **Settings** section. The initial sync takes longer to perform than subsequent syncs. Subsequent syncs occur about every 40 minutes, as long as the Azure AD provisioning service is running.
163
173
164
174
## Step 6: Monitor your deployment
175
+
165
176
After you've configured provisioning, use the following resources to monitor your deployment:
166
177
167
-
- Use the [provisioning logs](../reports-monitoring/concept-provisioning-logs.md) to determine which users have been provisioned successfully or unsuccessfully.
168
-
- Check the [progress bar](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md) to see the status of the provisioning cycle and how close it is to completion.
169
-
- If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. [Learn more about quarantine states](../app-provisioning/application-provisioning-quarantine-status.md).
178
+
* Use the [provisioning logs](../reports-monitoring/concept-provisioning-logs.md) to determine which users have been provisioned successfully or unsuccessfully.
179
+
* Check the [progress bar](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md) to see the status of the provisioning cycle and how close it is to completion.
180
+
* If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. [Learn more about quarantine states](../app-provisioning/application-provisioning-quarantine-status.md).
170
181
171
182
## Connector limitations
172
183
173
-
Snowflake-generated SCIM tokens expire in 6 months. Be aware that you need to refresh these tokens before they expire, to allow the provisioning syncs to continue working.
184
+
Snowflake-generated SCIM tokens expire in 6 months. Be aware that you need to refresh these tokens before they expire, to allow the provisioning syncs to continue working.
174
185
175
186
## Troubleshooting tips
176
187
177
-
The Azure AD provisioning service currently operates under particular [IP ranges](../app-provisioning/use-scim-to-provision-users-and-groups.md#ip-ranges). If necessary, you can restrict other IP ranges and add these particular IP ranges to the allow list of your application. That technique will allow traffic flow from the Azure AD provisioning service to your application.
188
+
The Azure AD provisioning service currently operates under particular [IP ranges](../app-provisioning/use-scim-to-provision-users-and-groups.md#ip-ranges). If necessary, you can restrict other IP ranges and add these particular IP ranges to the allowlist of your application. That technique will allow traffic flow from the Azure AD provisioning service to your application.
178
189
179
190
## Change log
180
191
181
192
* 07/21/2020: Enabled soft-delete for all users (via the active attribute).
0 commit comments