Microsoft Entra ID

Snowflake Provisioning Tutorial

28 October 2026Doc updateAction required+14 / −8 lines

In brief

The tutorial now links to Snowflake SCIM documentation, specifies using an account administrator, explains the SQL script, emphasizes that `AAD_PROVISIONER` is case-sensitive and uppercase, and adds related authentication links.

What Entra admins need to know

Use the clarified roles and capitalization when configuring provisioning, and refresh SCIM access tokens before their six-month expiry to keep synchronization working.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Step 2: Configure Snowflake to support provisioning with Microsoft Entra ID

Before you configure Snowflake for automatic user provisioning with Microsoft Entra ID, you need to enable System for Cross-domain Identity Management (SCIM) provisioning on Snowflake. For more information, see CREATE SECURITY INTEGRATION (SCIM).

Execute the following from either the Snowflake worksheet interface or SnowSQL.

use role accountadmin;
 create role if not exists aad_provisioner;
 grant create user on account to role aad_provisioner;
 grant create role on account to role aad_provisioner;
 grant role aad_provisioner to role accountadmin;
 create or replace security integration aad_provisioning
     type = scim
     scim_client = 'azure'
     run_as_role = 'AAD_PROVISIONER';
 select system$generate_scim_access_token('AAD_PROVISIONING');

~~Use~~ This script performs the ~~ACCOUNTADMIN role.~~following tasks:

Uses the ACCOUNTADMIN role.

![Screenshot of a worksheet in the Snowflake UI with the SCIM access token called out.](media/Snowflake-provisioning-tutorial/step-2.png)

~~Create~~Creates the custom role ~~AAD_PROVISIONER. All~~AAD_PROVISIONER. The users ~~and roles~~ in Snowflake created by Microsoft Entra ID isare owned by the scoped down AAD_PROVISIONER role.

![Screenshot showing the custom role.](media/Snowflake-provisioning-tutorial/step-3.png)

Let the ACCOUNTADMIN role create the security integration ~~using~~that uses the AAD_PROVISIONER custom role.

The value AAD_PROVISIONER is case-sensitive and must always be capitalized.

![Screenshot showing the security integrations.](media/Snowflake-provisioning-tutorial/step-4.png)

Create and copy the authorization token to the clipboard and store securely for later use. ~~Use this token for each SCIM REST API request and place it in the request header.~~ The access token expires after six months and a new access token can be generated with this statement. For more information, see SYSTEM$GENERATE_SCIM_ACCESS_TOKEN.

Connector limitations

Snowflake-generated SCIM tokens expire in 6 months. Be aware that you need to refresh these tokens before they expire, to allow the provisioning syncs to continue working. For more information, see SYSTEM$GENERATE_SCIM_ACCESS_TOKEN.

Just-in-time (JIT) application access with PIM for Groups

Managing user account provisioning for enterprise apps
What are application access and single sign-on with Microsoft Entra ID?
Configuring Snowflake SAML SSO
Configuring OpenID Connect (OIDC) federated authentication.
Snowflake also supports Workload Identity Federation and OAuth for applications and agents using Microsoft Entra.

Related content

@@ -42,9 +42,10 @@ The scenario outlined in this article assumes that you already have the followin  ## Step 2: Configure Snowflake to support provisioning with Microsoft Entra ID -Before you configure Snowflake for automatic user provisioning with Microsoft Entra ID, you need to enable System for Cross-domain Identity Management (SCIM) provisioning on Snowflake.+Before you configure Snowflake for automatic user provisioning with Microsoft Entra ID, you need to enable System for Cross-domain Identity Management (SCIM) provisioning on Snowflake. For more information, see [CREATE SECURITY INTEGRATION (SCIM)](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-scim). -1. Sign in to Snowflake as an administrator and execute the following from either the Snowflake worksheet interface or SnowSQL.+1. Sign in to Snowflake as an account administrator.+1. Execute the following from either the Snowflake worksheet interface or SnowSQL.     ```    use role accountadmin;@@ -52,27 +53,29 @@ Before you configure Snowflake for automatic user provisioning with Microsoft En     create role if not exists aad_provisioner;     grant create user on account to role aad_provisioner;     grant create role on account to role aad_provisioner;-   grant role aad_provisioner to role accountadmin;+    grant role aad_provisioner to role accountadmin;     create or replace security integration aad_provisioning         type = scim         scim_client = 'azure'         run_as_role = 'AAD_PROVISIONER';     select system$generate_scim_access_token('AAD_PROVISIONING');    ```+ +  This script performs the following tasks: -1. Use the ACCOUNTADMIN role.+  1. Uses the `ACCOUNTADMIN` role.      ![Screenshot of a worksheet in the Snowflake UI with the SCIM access token called out.](media/Snowflake-provisioning-tutorial/step-2.png) -1. Create the custom role AAD_PROVISIONER. All users and roles in Snowflake created by Microsoft Entra ID is owned by the scoped down AAD_PROVISIONER role.+  1. Creates the custom role `AAD_PROVISIONER`. The users in Snowflake created by Microsoft Entra ID are owned by the scoped down `AAD_PROVISIONER` role.      ![Screenshot showing the custom role.](media/Snowflake-provisioning-tutorial/step-3.png) -1. Let the ACCOUNTADMIN role create the security integration using the AAD_PROVISIONER custom role.+  1. Let the `ACCOUNTADMIN` role create the security integration that uses the `AAD_PROVISIONER` custom role.  The value `AAD_PROVISIONER` is case-sensitive and must always be capitalized.      ![Screenshot showing the security integrations.](media/Snowflake-provisioning-tutorial/step-4.png) -1. Create and copy the authorization token to the clipboard and store securely for later use. Use this token for each SCIM REST API request and place it in the request header. The access token expires after six months and a new access token can be generated with this statement.+1. Create and copy the authorization token to the clipboard and store securely for later use. The access token expires after six months and a new access token can be generated with this statement. For more information, see [SYSTEM$GENERATE_SCIM_ACCESS_TOKEN](https://docs.snowflake.com/en/sql-reference/functions/system_generate_scim_access_token).      ![Screenshot showing the token generation.](media/Snowflake-provisioning-tutorial/step-5.png) @@ -173,7 +176,7 @@ To configure automatic user provisioning for Snowflake in Microsoft Entra ID:  ## Connector limitations -Snowflake-generated SCIM tokens expire in 6 months. Be aware that you need to refresh these tokens before they expire, to allow the provisioning syncs to continue working.+Snowflake-generated SCIM tokens expire in 6 months. Be aware that you need to refresh these tokens before they expire, to allow the provisioning syncs to continue working. For more information, see [SYSTEM$GENERATE_SCIM_ACCESS_TOKEN](https://docs.snowflake.com/en/sql-reference/functions/system_generate_scim_access_token).  ## Just-in-time (JIT) application access with PIM for Groups @@ -227,6 +230,9 @@ The Microsoft Entra provisioning service currently operates under particular [IP  * [Managing user account provisioning for enterprise apps](~/identity/app-provisioning/configure-automatic-user-provisioning-portal.md) * [What are application access and single sign-on with Microsoft Entra ID?](~/identity/enterprise-apps/what-is-single-sign-on.md)+* [Configuring Snowflake SAML SSO](snowflake-tutorial.md)+* [Configuring OpenID Connect (OIDC) federated authentication](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-oidc).+* Snowflake also supports Workload Identity Federation and OAuth for applications and agents using Microsoft Entra.  ## Related content