Snowflake Service Account Username and Password Sunsetting

[Anonymous]

Snowflake currently allows users to hardcode a username and password. This is how we authenticate our Snowflake service account for PowerBI Service. 

In November, Snowflake will no longer allow hardcoded usernames and passwords. What is the solution for service accounts? We have Entra AD enabeled for PowerBI. I can authenticate myself in both desktop and service. 

What is the solution for a service account? Can you create a service account to authenticate with Entra AD?

What are organizations that do not use Entra AD going to do?

[v-ssriganesh · Accepted solution]

Hi @Anonymous,

Thank you for contacting the Microsoft Fabric community forum! You are right in saying that Snowflake will no longer support the hardcoded username and password authentication, so it's important to transition to a modern authentication method.

You mentioned that Entra ID is enabled. The best approach is to use OAuth authentication with a Service Principal. Here’s how you can do it:

• Create a Service Principal (App Registration) in Entra ID and Grant it the necessary permissions for Snowflake.

• Power BI can authenticate with Snowflake using OAuth instead of a hardcoded username/password.

• If your Power BI Service is running in an Azure-hosted environment, Managed Identity can be used for authentication.

Without Entra ID, you can use alternative authentication options such as external OAuth with other identity providers and key pair authentication.

If this helps then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.

[v-ssriganesh · Accepted solution]

Hi @Anonymous,
I am pleased to hear that you are progressing with this approach.

You're correct that Key Pair authentication is not supported in Power BI Service. Since Entra ID is not an option, a possible alternative you can try is Snowflake OAuth with an External Identity Provider.

Since you already have a service account user set up in Snowflake, create an External OAuth Integration in Snowflake and grant the necessary permissions by assigning the required role to the Service Principal. Use OAuth authentication in Power BI when connecting to Snowflake.

I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.

[Starriver]

@Anonymous : FYI: Snowflake released PAT (programmatic-access-tokens). One of our developers implemented it yesterday and it works perfectly for our service accounts. https://docs.snowflake.com/en/user-guide/programmatic-access-tokens

[v-ssriganesh · Accepted solution]

Hi @Anonymous,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

[v-ssriganesh]

Hi @Anonymous,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-ssriganesh · Accepted solution]

Hi @Anonymous,

Thank you for contacting the Microsoft Fabric community forum! You are right in saying that Snowflake will no longer support the hardcoded username and password authentication, so it's important to transition to a modern authentication method.

You mentioned that Entra ID is enabled. The best approach is to use OAuth authentication with a Service Principal. Here’s how you can do it:

• Create a Service Principal (App Registration) in Entra ID and Grant it the necessary permissions for Snowflake.

• Power BI can authenticate with Snowflake using OAuth instead of a hardcoded username/password.

• If your Power BI Service is running in an Azure-hosted environment, Managed Identity can be used for authentication.

Without Entra ID, you can use alternative authentication options such as external OAuth with other identity providers and key pair authentication.

If this helps then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.

[Anonymous]

Thank you. We are going to move forward with this approach. I already have the service account user set up in Snowflake. Do I need to do anything on the Snowflake side? Where do I 'grant the necessary permissions for Snowflake'? Am I just linking the new Service Principal to the existing service account in Snowflake?

For organizations that do not use Entra AD, they cannot use Key Pair authentication. PowerBI does not offer this as a solution. What do you suggest for those organizations to do?

[v-ssriganesh · Accepted solution]

Hi @Anonymous,
I am pleased to hear that you are progressing with this approach.

You're correct that Key Pair authentication is not supported in Power BI Service. Since Entra ID is not an option, a possible alternative you can try is Snowflake OAuth with an External Identity Provider.

Since you already have a service account user set up in Snowflake, create an External OAuth Integration in Snowflake and grant the necessary permissions by assigning the required role to the Service Principal. Use OAuth authentication in Power BI when connecting to Snowflake.

I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.