ARA-C01 · Question #172
A company is using a Snowflake account in Azure. The account has SAML SSO set up using ADFS as a SCIM identity provider. To validate Private Link connectivity, an Architect performed the following…
The correct answer is B. Add the IP address in the error message to the allowed list in the network policy. D. Update the configuration of the Azure AD SSO to use the Private Link URLs. The error 'IP XX.XXX.XX.XX is not allowed to access Snowflake' is triggered when the network policy blocks an IP that is not in the allowed range. In SAML SSO flows, the authentication redirect originates from the Azure AD / ADFS service - whose outbound IP may differ from the…
Question
A company is using a Snowflake account in Azure. The account has SAML SSO set up using ADFS as a SCIM identity provider. To validate Private Link connectivity, an Architect performed the following steps:
- Confirmed Private Link URLs are working by logging in with a username/password account
- Verified DNS resolution by running nslookups against Private Link URLs
- Validated connectivity using SnowCD
- Disabled public access using a network policy set to use the company's IP address range
However, the following error message is received when using SSO to log into the company account:
IP XX.XXX.XX.XX is not allowed to access snowflake. Contact your local security administrator. What steps should the Architect take to resolve this error and ensure that the account is accessed using only Private Link? (Choose two.)
Options
- AAlter the Azure security integration to use the Private Link URLs.
- BAdd the IP address in the error message to the allowed list in the network policy.
- CGenerate a new SCIM access token using system$generate_scim_access_token and save it to
- DUpdate the configuration of the Azure AD SSO to use the Private Link URLs.
- EOpen a case with Snowflake Support to authorize the Private Link URLs' access to the account.
How the community answered
(22 responses)- A23% (5)
- B64% (14)
- C5% (1)
- E9% (2)
Explanation
The error 'IP XX.XXX.XX.XX is not allowed to access Snowflake' is triggered when the network policy blocks an IP that is not in the allowed range. In SAML SSO flows, the authentication redirect originates from the Azure AD / ADFS service - whose outbound IP may differ from the corporate network IPs already whitelisted. Two fixes are needed: D - Update the Azure AD SSO application configuration to use the Snowflake Private Link URL (instead of the public Snowflake URL) so that SSO traffic stays on the private network and does not originate from an unexpected public IP. B - Add the IP shown in the error message (the Azure AD/ADFS service IP) to the network policy's allowed list, covering any SSO traffic that may still traverse the public path. Option A (altering the security integration) alone doesn't fix the network policy block. Option C (regenerating a SCIM token) addresses user provisioning, not authentication. Option E (opening a Snowflake Support case) is unnecessary since this is resolvable by the Architect.
Topics
Community Discussion
No community discussion yet for this question.