> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/configuration/integrations/snowflake.md).

# Snowflake

This page describes the recommended workflow for setting up Immuta with [Snowflake](/saas/configuration/integrations/snowflake/reference-guides/snowflake-overview.md). Following these steps connects your Snowflake environment, registers users, ingests metadata, and enables automated governance through global policies and access requests.

## Before you begin

To complete this workflow, ensure you have:

* Access to a Snowflake account and the permissions required to configure the connection
* An Immuta application administrator who can register the connection

For the recommended implementation described on this page, you should also have:

* An enterprise identity provider
* Identified owners or stewards for your major data domains
* An understanding of the metadata maintained in your external catalog, if you use one

{% hint style="info" icon="lightbulb" %}
Completing this workflow typically requires coordination among an Immuta application administrator, a Snowflake administrator, an identity administrator, governance users, and data stewards.
{% endhint %}

{% stepper %}
{% step %}

## Connect your Snowflake environment

1. An application administrator will [register the Snowflake connection](/saas/configuration/integrations/snowflake/how-to-guides/register-a-snowflake-connection.md) to allow Immuta to discover databases, schemas, and tables in Snowflake. As object sync runs, Immuta creates corresponding data sources that can be governed through policies or access requests.
2. After registering the connection, [organize your data into domains](/saas/configuration/domains/configure-domains.md). Domains assign ownership of data to the appropriate teams and determine who can manage policies, identification, audit, and access workflows for those data sources.

Once your [data sources](/saas/configuration/integrations/data-and-integrations/registering-metadata/data-source-overview.md) are registered in Immuta and organized into domains, you can apply policy to them.

{% hint style="info" icon="lightbulb" %}
Start by registering a select Snowflake business domain by [restricting the permissions of the Snowflake system account](/saas/configuration/integrations/snowflake/how-to-guides/register-a-snowflake-connection.md#set-up-the-immuta-system-account). Once your implementation is established, you can onboard additional data sources using the same governance model.
{% endhint %}
{% endstep %}

{% step %}

## Register and map your users

1. [Connect your organization's identity provider](/saas/configuration/people/section-contents/how-to-guides.md) and configure SSO so that users can authenticate with their existing credentials and be automatically registered in Immuta.
   1. If your identity provider supports SCIM, [enable provisioning to synchronize users, groups, and attributes](/saas/configuration/people/section-contents/reference-guides/scim-protocol.md). These attributes can then be used when authoring policies so access automatically changes as the user information in the IAM is synced with Immuta.
2. After your identity provider is configured, [map Snowflake user identities to Immuta users](/saas/configuration/people/users-index/how-to-guides/external-user-mapping.md#configure-external-user-id-mapping-on-app-settings-page). This ensures that policies written in Immuta are enforced for the correct users when they query data in Snowflake.

Once your users are registered and mapped to their Snowflake identities, any policies that apply to data sources will be enforced for those users.

{% hint style="info" icon="lightbulb" %}
If your identity provider supports SCIM, synchronize the user attributes that you plan to reference in policies, such as `department`, `region`, or `employment type`. These attributes provide a strong foundation for reusable global policies.
{% endhint %}
{% endstep %}

{% step %}

## Add metadata to your data

Metadata allows you to author policies that automatically apply across your Snowflake environment instead of managing individual tables and columns.

1. If your organization already maintains metadata in an external catalog, [connect your external catalog](/saas/configuration/tags/catalogs/configure.md) so Immuta continuously synchronizes tags, classifications, and descriptions.
2. You can also [enable identification to automatically discover and tag sensitive data](/saas/configuration/tags/data-discovery/how-to-guides/manage-sdd-tags.md). Identification is recommended for all deployments and is especially useful if you do not maintain an external catalog.

Once your data sources are tagged in Immuta, you can author global policies based on those tags. These policies can apply automatically as additional data sources are registered through object sync and tagged.
{% endstep %}

{% step %}

## Configure automated policies

Once users and metadata are available, begin authoring global policies that automatically protect your data.

1. [Create subscription policies](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/how-to-guides/subscription-policy-tutorial.md) to automatically grant access to users who meet the required conditions. You can also use subscription policies to enforce organization-wide requirements, such as limiting access to users with specific attributes or training before access can be granted.
2. [Create data policies](/saas/govern/secure-your-data/authoring-policies-in-secure/data-policies/how-to-guides/data-policy-tutorial.md) to mask sensitive columns or filter rows based on metadata such as catalog or identification tags.

Author global policies using metadata and user attributes instead of individual Snowflake objects or users. This allows the same policies to automatically apply as new data is registered and users are synchronized into Immuta.

{% hint style="info" icon="lightbulb" %}
A common first policy is to mask sensitive data identified through identification or your external catalog. As new Snowflake tables are registered and tagged, the policy automatically protects those columns without additional configuration.
{% endhint %}
{% endstep %}

{% step %}

## Configure access requests

Subscription policies can automatically grant access when users meet the required conditions. For access that requires review, configure the [Request app](/saas/request/introduction.md).

1. A governance user will [create request forms](/saas/request/review-access-requests/how-to-guides/manage-request-forms.md) and attach them to assets so users can [request access to Snowflake data from Snowflake](/saas/request/configure/how-to-guides/configure-access-request-links/snowflake-horizon.md).
2. If you use an external catalog, [configure access request links](/saas/request/configure/how-to-guides/configure-access-request-links.md) so users can request access directly from their catalog while continuing to use it as the primary location for data discovery.
3. Data stewards can then [review and respond to access requests](/saas/request/review-access-requests.md), and Immuta automatically provisions access when requests are approved.

Once access requests are configured, users can request access from Snowflake or your external catalog, and Immuta will route the request for review and provision access when it is approved.
{% endstep %}

{% step %}

## Configure audit

After your data, users, and policies are configured, [configure audit to export governance activity](/saas/govern/detect-your-data/audit/reference-guides/index.md).

Audit records provide visibility into user queries, policy evaluations, access requests, policy changes, and metadata updates, allowing your organization to monitor how data is accessed and governed across your Snowflake environment.
{% endstep %}
{% endstepper %}

## Next steps

**After completing this workflow, your Snowflake environment is ready for automated governance.** From here you can continue configuring advanced features, refining policies, and onboarding additional Snowflake data sources. See the [Snowflake integration reference guide](/saas/configuration/integrations/snowflake/reference-guides/snowflake-integration.md) for architecture details, platform behavior, and additional configuration options.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://documentation.immuta.com/saas/configuration/integrations/snowflake.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.