SnowPro Advanced Architect

By Snowflake · Question Mode

QuestionQ41

Secure Data Sharing and Consumption

A company uses a Snowflake account on Azure. The account has SAML SSO configured, with ADFS as a SCIM identity provider. To validate Private Link connectivity, an Architect completed the following steps:

  • Confirmed that the Private Link URLs work by logging in with a username/password account.
  • Verified DNS resolution by running nslookup commands against the Private Link URLs.
  • Validated connectivity with SnowCD.
  • Disabled public access by using a network policy configured with the company’s IP address range.

However, the following error is received when SSO is used to log in to the company account:

IP XX.XXX.XX.XX is not allowed to access snowflake. Contact your local security administrator.

What steps should the Architect take to resolve this error and ensure the account is accessed only through Private Link?

Choose two
Explanation

For SAML SSO over Azure Private Link, the Snowflake SAML2 security integration must specify the Private Link account URL as its issuer and assertion-consumer-service URL, and the Azure AD/ADFS SSO application must be configured to use the corresponding Private Link URLs. This keeps the SSO authentication flow on the private endpoint. Adding the identity provider’s public IP address to the network policy would allow public-path access instead of enforcing Private Link.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!