Power BI - Snowflake OAuth setup

Hi manoj_0911 

1. Authentication Flow Validation
Your understanding of the Azure AD External OAuth flow is correct. In this architecture, Snowflake acts as a Resource Server that validates tokens rather than an active client that queries the Azure directory.

Mechanism: Snowflake uses the public keys defined in your SECURITY INTEGRATION to verify the digital signature of the incoming OAuth token.

Mapping: The validation relies on matching the upn or email claim within the token to the LOGIN_NAME property of the Snowflake user.

External Tenant Context: Since the Power BI tenant belongs to the customer, they must register the Snowflake Power BI infrastructure as an Enterprise Application in their Azure AD and grant the necessary API permissions (e.g., session:role-any).

2. Network Access & Scheduled Refresh
If Snowflake network policies are enabled, a scheduled refresh in Power BI Service will fail unless specific provisions are made.

The Challenge: Power BI Service traffic originates from Microsoft’s shared cloud infrastructure. These outbound IP addresses are dynamic and change frequently.

Requirement: You must add the Power BI Service Tags (or the specific Azure Region IP ranges) to the Snowflake Network Policy ALLOWED_IP_LIST.

Production Best Practice: Relying on public IP whitelisting for cloud services can be management-heavy. For a hardened production environment, consider using an Azure Private Link between the Power BI VNET (via a VNET Gateway) and Snowflake to ensure traffic never touches the public internet.

3. Additional Prerequisites & Best Practices
To ensure a robust implementation across external tenants, consider the following:

Audience Claim: Ensure the EXTERNAL_OAUTH_AUDIENCE_LIST in your Snowflake integration matches the Application ID URI configured in the customer’s Azure AD.

Admin Consent: Since this is a cross-tenant setup, a Global Admin from the customer’s Azure AD must grant "Tenant-wide admin consent" to the Snowflake application for the OAuth flow to work for all users.

Role Mapping: If you intend to use specific Snowflake roles, ensure the OAuth token includes the session:role:<role_name> scope; otherwise, the connection will default to the user's DEFAULT_ROLE.

Desktop vs. Service: Remember that Power BI Desktop uses the developer's local network (VDI) to connect, while the Power BI Service uses Microsoft's data center IPs. Both must be accounted for in your network policies.