--- title: Provisioning Snowflake with PingOne description: Provision Snowflake with PingOne. component: pingone page_id: pingone:integrations:p1_provisioning_connection_snowflake canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_provisioning_connection_snowflake.html llms_txt: https://docs.pingidentity.com/pingone/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: July 8, 2026 section_ids: provisioning-capabilities: Provisioning capabilities before-you-begin: Before you begin steps: Steps validation: Validation snowflake-directory-attributes: Snowflake directory attributes snowflake-provisioning-known-limitations: Snowflake provisioning known limitations --- # Provisioning Snowflake with PingOne By using the Snowflake connection in PingOne, you can synchronize users between Snowflake and PingOne through inbound and outbound provisioning. The Snowflake connection also supports Snowflake roles and database roles at the connection level. ## Provisioning capabilities The following table summarizes the inbound and outbound provisioning capabilities for each resource type: | Resource | Capability | Description | Inbound | Outbound | | ---------- | -------------- | ------------------------------------------------------------ | ------- | -------- | | User | Create | Generates a new user record in the destination. | Yes | Yes | | | Read | Retrieves or polls user attributes for synchronization. | Yes | Yes | | | Update | Modifies existing attributes, such as `first name`. | Yes | Yes | | | Delete | Deletes a user or temporarily suspends an account. | Yes | Yes | | Group | Create | Provisions a new group in the target application. | No | No | | | Rename | Updates the display name or identifier of an existing group. | No | No | | | Delete | Removes a group from the target application. | No | No | | Membership | Add and remove | Adds or removes users from groups. | No | No | ## Before you begin Make sure that you have: * A Snowflake account. Learn more in [create a Snowflake account](https://signup.snowflake.com/). * An authorization token or the following JWT token details from your Snowflake account: * **JWT PEM** * **JWT Expiration** * **JWT Algorithm** * **Key Algorithm** * **JWT Claims (JSON)** * Users created and assigned to a group specifically for Snowflake provisioning in PingOne. Learn more in [Adding a user in PingOne](../directory/p1_adduser.html) and [Managing groups](../directory/p1_managing_groups.html). ## Steps 1. Create a Snowflake connection: 1. In the PingOne admin console, go to **Integrations > Provisioning**. 2. Click **[icon: plus, set=fa]**and then click **New Connection**. 3. Click **Select** for **Identity Store**. 4. Click **Select** for the **Snowflake** connection, and click **Next**. 5. Enter a **Name** and **Description** for this provisioning connection. 6. Click **Next**. 7. In the **Configure Authentication** section, select the **Authentication Method** to apply to your Snowflake account. Choose from: * For **JWT\_TOKEN**, enter the following: | Configuration | Example | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | **JWT PEM** | `MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDbt7EyGhPuI3Vf1XDmXcrc4…​` | | **JWT Expiration** | `60` | | **JWT Algorithm** | `RS256` | | **Key Algorithm** | `RSA` | | **JWT Claims (JSON)** | `{ "iss": "RAEYFEY-XL55718.DEVINTEGRATION.SHA256:WIH3ctNrf3k/6qyY2ckX3uLiiMrswwcsCCpipP4yCEE=", "sub": "RAEYFEY-XL55718.DEVINTEGRATION" }` | * For **TOKEN**, enter the bearer token from your Snowflake account, such as `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9`. 8. Click **Next**. 9. In the **User Actions** section, enter the following as needed: | Field | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Enable users creation** | Creates a user in the target identity store when the user is created in the source identity store. | | **Enable users updation** | Updates user attributes in the target identity store when the user is updated in the source identity store. | | **Enable users deprovision** | Deprovisions a user in the target identity store when the user is deprovisioned in the source identity store. If **Enable users deprovision** is selected, the following options appear:- **Remove Action**: Select **Delete** to remove a user in the target identity store when the user is deleted in the source identity store. - **Deprovision on rule deletion**: Deprovisions users if the associated provisioning rule is deleted. | 10. Click **Save**. 11. To enable the connection, click the toggle at the top of the details panel to the right (blue). | | | | - | ------------------------------------------------------------------------- | | | You can disable the connection by clicking the toggle to the left (gray). | 2. Create an [inbound](p1_create_provisioning_rule_inbound.html) or [outbound](p1_create_provisioning_rule_outbound.html) rule and select the existing Snowflake connection as the target or source. You can optionally add [attribute mappings](#snowflake-directory-attributes). Use the following inbound mapping examples for the Snowflake rule configuration: | Snowflake | PingOne Directory | | ------------ | ----------------- | | `!disabled` | `Enabled` | | `email` | `Email Address` | | `last_name` | `Family Name` | | `first_name` | `Given Name` | | `name` | `Username` | Use the following outbound mapping examples for the Snowflake rule configuration: | PingOne Directory | Snowflake | | ----------------- | ------------ | | `Username` | `name` | | `Given Name` | `first_name` | | `!enabled` | `disabled` | | `Email Address` | `email` | ## Validation Confirm users and groups are successfully provisioned to Snowflake. View the [sync status](p1_view_sync_status.html) to review synchronization results and any errors. You can find examples in [Outbound provisioning sync summary examples](p1_outbound_group_provisioning_sync_summary_examples.html). ## Snowflake directory attributes The following table lists common Snowflake attributes that can be mapped for user provisioning: | Attribute | Description | | ------------ | ------------------------------------------------------------------------------------------------- | | `name` | The Snowflake username attribute used for synchronization and required outbound username mapping. | | `email` | The user email attribute used for synchronization and email mapping. | | `first_name` | The user's given name. | | `last_name` | The user's family name. | | `disabled` | The Snowflake enabled or disabled state used in the current inbound and outbound mappings. | ## Snowflake provisioning known limitations The PingOne `username` attribute is mapped to the `name` attribute in Snowflake. Because the `name` attribute in Snowflake is immutable, any updates to a user's `username` in PingOne during outbound synchronization will fail to update the corresponding value in Snowflake.