Mirroring Snowflake with a Managed Identity?

[henrituol]

What are the options to authenticate into Snowflake when mirroring into Fabric? At the moment, the Fabric tutorials point to Snowflake Username & Password authentication. Also, "Entra (single sign on (SSO)) are supported".

However, Snowflake will require MFA in the future. Doesn't this mean, these options are invalid in the future? Can we use Managed Identity to authenticate into Snowflake? Fabric Rest API Create Mirrored Database seems to hint into this direction, but I cannot make these various parts fit together.

Is it possible to use Service Principal to connect into Snowflake?

[fredguis]

Hi Henrituol, I just sent you a private message to explore your scenario in more detail and collect product feedback. Looking forward to learning more about your use case!

[v-pnaroju-msft]

Hi henrituol,

We are following up once again regarding your query. Kindly confirm whether the issue has been resolved through the support ticket with Microsoft. If the issue has been resolved, we would be grateful if you could share the resolution or key insights here to assist others in the community.
In the event that we do not receive a response, we will proceed to close this thread. Should you require any further assistance in the future, we encourage you to reach out via the Microsoft Fabric Community Forum by initiating a new thread. We will be happy to assist you.

Thank you.

[v-pnaroju-msft]

Hi henrituol,

Thank you for sharing your insights. We appreciate your contribution to the discussion, as it helps other community members facing similar queries.

We are following up to check whether the support ticket raised from your end has provided a resolution to the issue. If it has, we kindly request you to share the solution with the community and mark it as the accepted solution, as this will assist others facing similar challenges and benefit the broader community.

Thank you.

[v-pnaroju-msft]

Hi henrituol,

We are following up to see if your query has been resolved.If you have found any other solution, we would be grateful if you could share it with the community and mark it as the accepted solution. This will help others facing similar issues and benefit the community.

Thank you.

[henrituol · Accepted solution]

Unfortunately, this is still unresolved. I opened a support ticket with Microsoft and they are still "working with the Product Group regarding the authentication types supported in the future for snowflakes mirroring considering the MFA mandate".

[v-pnaroju-msft]

Thank you, @nilendraFabric , for your response.

Hi @henrituol,

We appreciate your inquiry on the Microsoft Fabric Community Forum.

Thank you for highlighting the impact of Snowflake MFA on Fabric mirroring.

As mentioned in the document Limitations for Microsoft Fabric Mirrored Databases From Snowflake - Microsoft Fabric | Microsoft Le..., Fabric mirroring currently supports Snowflake connections mainly through username/password and Entra ID SSO.

If you have found any other solution, we would be grateful if you could share it with the community and mark it as the accepted solution. This will help others facing similar issues and benefit the community.

Thank you.

[henrituol]

I suppose it is possible to use Microsoft Authentication after all. In Entra ID, you can exclude a user from MFA. Some organizations utilize Shared Accounts for services—these do not seem to be a proper service entity like a Service Principal or Managed Identity, but at least they are not tied to a single user. Snowflake receives tokens from Entra ID; therefore, I assume mandatory MFA won't affect this connection. As long as you have a corresponding user in Snowflake, you can set up a user with a restricted role that exposes the BI layer for Fabric.

[nilendraFabric]

Hello @henrituol 

Fabric mirroring currently lacks native Snowflake service principal integration.

Managed Identity (SAMI): Supported for Azure SQL mirroring but not available for Snowflake in Fabric.

as you have pointed  out REST API seems to be only option which can be explored around

And it has support for SPN and MI's

Hope this helps. 

Please accept the answer if this is helpful

[henrituol]

Looks like the Microsoft Entra supported identities refer to using the REST API, not the actual underlying payload to create the connection. It seems that there's no way to make the connection with a service principal.

Also, if someone is interested, here's the announcement in snowflake.com: https://www.snowflake.com/en/blog/blocking-single-factor-password-authentification/

[henrituol]

Thanks! I'll check the REST API to see if I can establish a connection. However, I do hope Microsoft addresses this issue, because it seems that when MFA becomes mandatory, native integration will be needed.