Microsoft Entra ID
StandardsSnowflake Provisioning Tutorial
In brief
The tutorial’s task lists were changed from numbered items to bullet points; the instructions and screenshots remain the same.
What Entra admins need to know
No administrator action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
select system$generate_scim_access_token('AAD_PROVISIONING');
This script performs the following tasks:
1.* Uses the `ACCOUNTADMIN` role.
1.* Creates the custom role `AAD_PROVISIONER`. The users in Snowflake created by Microsoft Entra ID are owned by the scoped down `AAD_PROVISIONER` role.
1.* Let the `ACCOUNTADMIN` role create the security integration that uses the `AAD_PROVISIONER` custom role. The value `AAD_PROVISIONER` is case-sensitive and must always be capitalized.
1. Create and copy the authorization token to the clipboard and store securely for later use. The access token expires after six months and a new access token can be generated with this statement. For more information, see [SYSTEM$GENERATE_SCIM_ACCESS_TOKEN](https://docs.snowflake.com/en/sql-reference/functions/system_generate_scim_access_token).
@@ -61,19 +61,19 @@ Before you configure Snowflake for automatic user provisioning with Microsoft En select system$generate_scim_access_token('AAD_PROVISIONING'); ``` - This script performs the following tasks:+ This script performs the following tasks: - 1. Uses the `ACCOUNTADMIN` role.+ * Uses the `ACCOUNTADMIN` role. - +  - 1. Creates the custom role `AAD_PROVISIONER`. The users in Snowflake created by Microsoft Entra ID are owned by the scoped down `AAD_PROVISIONER` role.+ * Creates the custom role `AAD_PROVISIONER`. The users in Snowflake created by Microsoft Entra ID are owned by the scoped down `AAD_PROVISIONER` role. - +  - 1. Let the `ACCOUNTADMIN` role create the security integration that uses the `AAD_PROVISIONER` custom role. The value `AAD_PROVISIONER` is case-sensitive and must always be capitalized.+ * Let the `ACCOUNTADMIN` role create the security integration that uses the `AAD_PROVISIONER` custom role. The value `AAD_PROVISIONER` is case-sensitive and must always be capitalized. - +  1. Create and copy the authorization token to the clipboard and store securely for later use. The access token expires after six months and a new access token can be generated with this statement. For more information, see [SYSTEM$GENERATE_SCIM_ACCESS_TOKEN](https://docs.snowflake.com/en/sql-reference/functions/system_generate_scim_access_token).