Detections
Analytics

1.2 Ensure Snowflake SCIM integration is configured to automatically provision and deprovision users and groups (i.e. roles)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The System for Cross-domain Identity Management (

SCIM

) is an open specification designed to help facilitate the automated management of user identities and groups (i.e. roles) in cloud applications using RESTful APIs.

Snowflake supports SCIM 2.0 integration with Okta, Microsoft Azure AD and custom identity providers. Users and groups from the identity provider can be provisioned into Snowflake, which functions as the service provider.

While SSO enables seamless authentication with a federated identity to the Snowflake application, user accounts still need to be created, managed, and deprovisioned. Operations like adding and deleting users, changing permissions, and adding new types of accounts usually take up valuable admin time and when done manually may be error-prone.

With SCIM, user identities can be created either directly in your identity provider, or imported from external systems like HR software or Active Directory. SCIM enables IT departments to automate the user provisioning and deprovisioning process while also having a single system to manage permissions and groups. Since data is transferred automatically, risk of error is reduced.

Solution

Follow the instructions in the Snowflake documentation to set up SCIM configuration for

Okta

,

Azure AD,

or configure a

custom SCIM integration

.

Impact:

None.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|16.2

Plugin: Snowflake

Control ID: de7b303cd404d0c0bb9fcaadc1c9445abb87004984f8eb9b0bdc4b6c24e7fddb