# SailPoint Snowflake SaaS Connector Documentation

> Snowflake SaaS Connector Documentation

# Documentation

# Connecting SailPoint and Snowflake SaaS

To connect SailPoint with Snowflake, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
5. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
7. Select **Save**.

## Connection Settings

Provide the information required to connect and interact with the source.

You can use the following commands to query the Snowflake system to find the URL, Organization, and Account information:

```text
USE ROLE ORGADMIN;
SHOW ORGANIZATION ACCOUNTS;
```

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/connection.png>)](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/connection.png>)

To configure connection settings, complete the following:

1. Enter the **Base URL** to connect to the Snowflake system. For example, `https://<organization>-<account>.snowflakecomputing.com`.
2. Select the **Authentication Type** used to connect to the Snowflake system.
3. Enter the **Organization** configured in the Snowflake organization.
4. Enter the Snowflake **Account** configured for the Snowflake organization.
5. Enter the **Username** to log into the Snowflake organization account.
6. Enter the **Private Key** used to authenticate with the Snowflake system. For more information on generating private keys, refer to [Generating Keys](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/index.html#generating-keys>).

   > **Note**
   >
   > When you enter the private key you must enter the whole private key, including the BEGIN PRIVATE KEY and END PRIVATE KEY lines. For example:
   >
   > ```text
   > -----BEGIN ENCRYPTED PRIVATE KEY-----
   > *HASH VALUE*
   > -----END ENCRYPTED PRIVATE KEY-----
   > ```
7. Enter the **Passphrase** to validate the private key. This was created when you generated the public and private keys.
8. Select **Save**.

### Configure Database Filter Settings

You can enter the names of any databases to include or exclude from connector operations.

> [!CAUTION]
>
> Configuring the connector to include some databases and simultaneously exclude others may cause aggregation processes to fail.

> [!NOTE]
>
> If the database name contains any lowercase letters or special characters other than an underscore ( `_` ), enclose the name in double quotes ( `"` ).
>
> For example, you can enter the following:
>
> ```text
> SNOWFLAKE, SALES_DB, "hr@DB", "admin-db"
> ```

1. Do either of the following:

   - In the **Include Databases** field, enter a comma-separated list of databases names to include in aggregation and provisioning operations.
   - In the **Exclude Databases** field, enter a comma-separated list of databases names to exclude from aggregation and provisioning operations.
2. Select **Save**.

## Configuring Machine Identity Governance

Enable the connector to aggregate Snowflake Cortex Agents in aggregation processes.

Before you start, you must set the required permissions in the source to aggregate Snowflake Cortex Agents. For more information, refer to [Machine Identity Aggregation Permissions](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/index.html#machine-identity-aggregation-permissions>).

> [!NOTE]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/agent_governance.png>)](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/agent_governance.png>)

1. Select **Enable Snowflake Cortex Agent**.
2. Select **Save**.

## Aggregation Settings

On the Aggregation Settings page, configure the filter settings. Filter settings allow users to filter Snowflake users and roles based on attributes.

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/fltr.png>)](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/img/fltr.png>)

1. Enter the **Account Filter** conditions. For example,

   ```text
   "name" ILIKE '%SailpointUser%' AND "login_name" ILIKE '%SailpointLogin%'
   ```

   > **Note**
   >
   > The attribute name should start and end with double quotes (" "), and the value should start and end with single quotes (' ').
2. Enter the **Role Filter** conditions. For example,

   ```text
   "name" ILIKE '%SYSADMIN%' AND "owner" = 'XYZ'
   ```

   > **Note**
   >
   > - The attribute name should start and end with double quotes (" "), and the value should start and end with single quotes (' ').
   > - The above examples are SQL queries `where` clause conditions, however, you may add any clause condition of SQL queries.
3. Select the **Validate Filters During Test Connection** option to enable it. The filter works in the background by running multiple SQL statements in a single request. For example,

   ```text
   SHOW USERS; SELECT * FROM TABLE(RESULT_SCAN(LAST_QUERY_ID())) WHERE "name" ILIKE '%SailpointUser %' AND "owner" = 'ACCOUNTADMIN';
   ```
4. Select **Save**.

## Activity Insights Settings

SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](<https://documentation.sailpoint.com/saas/help/ai/activity_insights/index.html>).

Activity Insights Settings allows you to gather account information and activity data from Snowflake. To enable Activity Insights for the Snowflake application, refer to [Prerequisites](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/index.html#prerequisites>) for more information.

To configure Activity Insights, complete the following:

> [!NOTE]
>
> **Screenshot**
>
> [![Activity Insights Settings](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/common/assets/img/activity_insights.png>)](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/common/assets/img/activity_insights.png>)

1. Go to **Activity Insights Settings**.
2. Select **Enable Activity Insights** to view access to data insights on source and application activity such as logins and other app-specific events.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Snowflake SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

The connector uses datasets to schedule aggregation of the following resource types:

| Dataset | Resource Type | Associated Resources |
| --- | --- | --- |
| Snowflake Cortex Agents | Agent | [Snowflake Cortex Agent](<#snowflake-cortex-agent-attributes>) |
| Snowflake Cortex Agents | Capability | [Cortex MCP Server](<#cortex-mcp-server>), [Cortex Skill](<#cortex-skill>), [Cortex Analyst](<#cortex-analyst>), [Cortex Search](<#cortex-search>), [Cortex Generic Tool](<#cortex-generic-tool>), [Cortex Web Search](<#cortex-web-search>), [Cortex Data to Chart](<#cortex-data-to-chart>), [Cortex Code Execution](<#cortex-code-execution>) |

## Supported Resources

A resource represents a type of object the connector collects from Snowflake, such as Cortex agents, MCP servers, or skills. Each resource defines the attributes collected for that object type, such as name, ID, or status, and how each object appears in SailPoint.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Under **Dataset Management** \> **Resources**, the Snowflake source lists each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab.

The Snowflake Cortex Agents dataset contains the following resources:

| Resource Name | Resource Type | Resource ID |
| --- | --- | --- |
| Snowflake Cortex Agent | Agent | `snowflake:cortex-agent` |
| Cortex MCP Server | Capability | `snowflake:cortex-mcp-server` |
| Cortex Skill | Capability | `snowflake:cortex-skill` |
| Cortex Analyst | Capability | `snowflake:cortex-analyst` |
| Cortex Search | Capability | `snowflake:cortex-search` |
| Cortex Generic Tool | Capability | `snowflake:cortex-generic` |
| Cortex Web Search | Capability | `snowflake:cortex-web-search` |
| Cortex Data to Chart | Capability | `snowflake:cortex-data-to-chart` |
| Cortex Code Execution | Capability | `snowflake:cortex-code-execution` |

For schema attribute definitions, refer to the following pages:

- [Snowflake Cortex Agent Attributes](<#snowflake-cortex-agent-attributes>)
- [Cortex Capability Attributes](<#cortex-capability-attributes>)

## Snowflake Cortex Agent Attributes

Schema attributes for the **Snowflake Cortex Agent** resource.

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-agent` |
| Resource type | `std:agent` |
| Identity attribute | `identity` |
| Display attribute | `name` |

### Attributes

| Attribute | Type | Description |
| --- | --- | --- |
| `comment` | string | Comment text for the agent. |
| `created_on` | string | Timestamp when the agent was created. |
| `database_name` | string | Name of the database that contains the agent. |
| `identity` | string | Fully qualified name of the agent, formatted as `database_name.schema_name.name`. Designated as the Resource ID attribute. |
| `instructions` | string | Instructions defining the agent's response and orchestration behavior. |
| `model` | string | Primary model used by the agent (for example, `claude-opus-4-5`). |
| `name` | string | Name of the agent. Designated as the Resource Name attribute. |
| `owner` | string | Owner role of the agent. |
| `profile` | string | Profile configuration of the agent. |
| `roles` | string | Snowflake roles that have privileges on this agent. |
| `schema_name` | string | Name of the schema that contains the agent. |
| `spBusinessApplication` | string | Standardized SailPoint business application identifier. |
| `spDescription` | string | Agent description, mapped from the Snowflake agent COMMENT attribute. |
| `tool_unable_to_answer` | string | Fallback message displayed when no tool can answer a query. |

## Cortex Capability Attributes

Schema attributes for Cortex capability resources in the **Snowflake Cortex Agents** dataset.

### Cortex MCP Server

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-mcp-server` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `fqn` |

| Attribute | Type | Description |
| --- | --- | --- |
| `fqn` | string | Fully qualified name of the MCP server object. Designated as the Resource Name attribute. |
| `identity` | string | Fully qualified name of the MCP server. Designated as the Resource ID attribute. |

### Cortex Skill

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-skill` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Identity of the skill, formatted as `stage_fqn.skill_folder_dotted`. Designated as the Resource ID attribute. |
| `name` | string | Name of the skill folder. Designated as the Resource Name attribute. |
| `path` | string | Full Snowflake stage path, formatted as `@stage/folder/`. |
| `skill_folder` | string | Relative folder path of the skill within the stage. |
| `skill_type` | string | Type of the skill, such as `STAGE` or `GIT`. |
| `stage` | string | Fully qualified name of the stage hosting the skill. |

### Cortex Analyst

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-analyst` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Fully qualified name of the Semantic view or model file. Designated as the Resource ID attribute. |
| `name` | string | Fully qualified name of the Semantic view or model file. Designated as the Resource Name attribute. |
| `source_type` | string | Type of source, such as `semantic_view` or `semantic_model_file`. |

### Cortex Search

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-search` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `search_service` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Fully qualified name of the Cortex Search service. Designated as the Resource ID attribute. |
| `search_service` | string | Fully qualified name of the search service. Designated as the Resource Name attribute. |

### Cortex Generic Tool

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-generic` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Fully qualified name of the function or procedure, including its argument signature (for example, `DB.SCHEMA.SCORE_CUSTOMER(VARCHAR)` or `DB.SCHEMA.SCORE_CUSTOMER()`). Designated as the Resource ID attribute. |
| `name` | string | Function or procedure name with its argument signature (for example, `SCORE_CUSTOMER(VARCHAR)` or `SCORE_CUSTOMER()`). Designated as the Resource Name attribute. |
| `type` | string | Object type, such as `procedure` or `function`. |

### Cortex Web Search

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-web-search` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Singleton identity for the `web_search` capability. Designated as the Resource ID attribute. |
| `name` | string | Name of the `web_search` capability. Designated as the Resource Name attribute. |

### Cortex Data to Chart

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-data-to-chart` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Singleton identity for the `data_to_chart` capability. Designated as the Resource ID attribute. |
| `name` | string | Name of the `data_to_chart` capability. Designated as the Resource Name attribute. |

### Cortex Code Execution

| Property | Value |
| --- | --- |
| Resource ID | `snowflake:cortex-code-execution` |
| Resource type | `std:capability` |
| Identity attribute | `identity` |
| Display attribute | `name` |

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Singleton identity for the `code_execution` capability. Designated as the Resource ID attribute. |
| `name` | string | Name of the `code_execution` capability. Designated as the Resource Name attribute. |

# Integrating SailPoint with Snowflake SaaS

The SailPoint Snowflake SaaS integration is capable of end-to-end user administration with the provisioning and password management capabilities of Snowflake, helping provide rich governance and control experience to your enterprise deployment.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Snowflake SaaS source.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SailPoint Snowflake SaaS connector supports the following features.

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to [Working With Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>).

#### Account Management

- Manages Snowflake Users
- Aggregate and Refresh Accounts
- Create and Update Accounts
- Enable, Disable, Unlock, and Change Password
- Add or Remove Entitlements

#### Entitlement Management

- Manages Snowflake Entitlements as Role
- Refresh and Aggregate Entitlements

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

#### Non-Human Identity Discovery

- Aggregate Snowflake Cortex Agents

  > **Note**
  >
  > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

#### Activity Insights

Activity Insights supports activity from Snowflake and its associated accounts. This allows you to gather account information and activity data from Snowflake.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/connecting.html#activity-insights-settings>).

## Prerequisites

- To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format. For more information, refer to [Generating Keys](<#generating-keys>).

  > **Note**
  >
  > - SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security.
  > - By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to [OpenSSL](<https://www.openssl.org/source/>) to download OpenSSL for Windows.

### Generating Keys

To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format.

> [!NOTE]
>
> - SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security.
> - By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to [OpenSSL](<https://www.openssl.org/source/>) to download OpenSSL for Windows.
> - The generated private key is required as an input on the **Connection Settings** page.

To generate the private and public keys, complete the following:

1. On your system, open a command prompt, terminal, or emulator and use the following command to generate an encrypted version of the private key: `openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8`

   The command to generate an encrypted key prompts you to enter a passphrase to regulate access to the key. SailPoint recommends storing the passphrase in a secure location.
2. Use the following command to generate an encrypted version of the public key: `openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub`
3. Copy the public and private key files to a local directory for storage. Record the path to the files.

   > **Note**
   >
   > The private key is stored using the PKCS\#8 (Public Key Cryptography Standards) format and is encrypted using the passphrase you specified in the first step. However, the file should still be protected from unauthorized access using the file permission mechanism provided by your operating system. It is your responsibility to secure the file when it is not being used.

## Required Permissions

Configure the permissions required to grant necessary access rights to resources or data within the system to perform connector operations.

### Administrative Account Permissions

Complete the following to set up a Snowflake administrative account with the minimum required permissions for the listed operation:

1. Log in to Snowflake with the `ACCOUNTADMIN` role and execute the following command:

   ```text
   CREATE USER "UserName" type = SERVICE;
   ```

   > **Note**
   >
   > SailPoint recommends setting the user to the `Service` type.
2. Generate the public key. The public key is in the PEM format. For more information on generating the public key, refer to [Generating Keys](<#generating-keys>). The following is an example of the public key in PEM format:

   ```text
   -----BEGIN PUBLIC KEY-----
   MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy+Fw2qv4Roud3l6tjPH4
   zxybHjmZ5rhtCz9jppCV8UTWvEXxa88IGRIHbJ/PwKW/mR8LXdfI7l/9vCMXX4mk
   ...
   -----END PUBLIC KEY-----
   ```
3. In the following command, replace `PublicKey` with the key you generated (do not include the `BEGIN PUBLIC KEY` and `END PUBLIC KEY` lines):

   ```text
   ALTER USER "UserName" SET RSA_PUBLIC_KEY='PublicKey';
   ```

   For example:

   ```text
   ALTER USER MYUSER SET RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1hhZwJvU4+MiD92bLLmf
   zvdieU6TvuaSrjKJGtEndSWRR3p2pMFIzDWbbX1PHPqtt43C+meMtKtwMVl8JWEk
   IawC7ZnfjHROufWVhpb+8DwhHuH/r7GWXCNCyjJTH/Z+htdIYFM/pbSKW1Qdt5X0
   Bf5TGINAe9XxL2Zp5kqo8pYMiPGudgUdYQlMGZ6y1AH0Rcb76KUkoHNrJQA/xRI8
   LSDMNJQSJo6rPGARD1Rn9ns0Z3M1qnoH6LOOX0GX3T4GU+ERwPaMVcMjkweSA3a1
   sqLhq+9hpC8piW+LaEv2clj1Sp73m70qh/0l8Cb2O4sq7Iov8G8Iahe0LGLVQX3+
   uQIDAQAB';
   ```
4. Use the following command to verify the user's public key fingerprint:

   ```text
   DESCRIBE USER "UserName";
   ```
5. Use the following command to set a user's default role:

   ```text
   ALTER USER "UserName" SET DEFAULT_ROLE = "Rolename";
   ```

### SYSADMIN Role

Snowflake recommends creating a hierarchy of custom roles, with the top-most custom role assigned to the system role `SYSADMIN`. For more information, refer to the [Snowflake documentation](<https://docs.snowflake.com/en/user-guide/security-access-control-overview.html#custom-roles>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

1. Use the following command to create a role:

   ```text
   CREATE ROLE "Rolename";
   ```
2. Use the following command to assign the SYSADMIN role to the new role:

   ```text
   GRANT ROLE "Rolename" TO ROLE SYSADMIN;
   ```

### Role Permissions

Use the following command to grant a role to a user:

```text
GRANT ROLE "Rolename" TO USER "UserName";
```

Use the following command to set a user's default role:

```text
ALTER USER "UserName" SET DEFAULT_ROLE = "Rolename";
```

### Test Connection Permissions

By default, when you create a user, it is assigned a bare minimum role (PUBLIC). Only a bare minimum role is required for to test your connection.

### Account Aggregation Permissions

This command can only be executed by users with a role that has the `MANAGE GRANTS` global privilege.

```text
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE "Rolename";
```

Create a new warehouse if one doesn't already exist.

```text
CREATE WAREHOUSE "WAREHOUSE_NAME" ;
```

Use the following command to set `default_warehouse` to a user.

```text
ALTER USER "UserName" SET DEFAULT_WAREHOUSE = "WAREHOUSE_NAME";
```

Use the following command to provide warehouse usage on the role.

```text
GRANT USAGE ON WAREHOUSE "WAREHOUSE_NAME" TO ROLE "RoleName";
```

### Machine Identity Aggregation Permissions

Grant the following permissions to include Snowflake Cortex Agent accounts in aggregation processes.

- Minimum requirement per database that holds Cortex Agents:

  ```text
  GRANT USAGE ON DATABASE "<DATABASE_NAME>" TO ROLE "Rolename";
  GRANT USAGE ON SCHEMA "<DATABASE_NAME>"."<SCHEMA_NAME>" TO ROLE "Rolename";
  ```
- (*Optional*) Use the following to avoid granting schemas one-by-one:

  ```text
  GRANT USAGE ON ALL SCHEMAS IN DATABASE "<DATABASE_NAME>" TO ROLE "Rolename";
  ```
- (*Optional*) Use the following to auto-cover new schemas created later on:

  ```text
  GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "<DATABASE_NAME>" TO ROLE "Rolename";
  ```

### Group Aggregation Permissions

By default, when you create a user, it is assigned a bare minimum role (PUBLIC). Only a bare minimum role is required to perform a group aggregation.

### Create Account Permissions

The CREATE command can only be executed by users with a role that has the CREATE USER global privilege.

```text
GRANT CREATE USER ON ACCOUNT TO ROLE "Rolename";
```

### Modify, Enable, Disable, Unlock, or Change Password Permissions

Note the following with the OWNERSHIP privilege:

- The OWNERSHIP privilege grants the ability to delete, alter, rename, and grant or revoke access to an object.
- OWNERSHIP is a special privilege on an object that is automatically granted to the role that created the object, but can also be transferred to a different role by the owning role (or any role with the MANAGE GRANTS privilege) using the `GRANT OWNERSHIP` command.
- The OWNERSHIP privilege grants full control over an object. Only a single role can hold this privilege on a specific object at a time. For more information on the GRANT OWNERSHIP command, refer to the [Snowflake documentation](<https://docs.snowflake.com/en/sql-reference/sql/grant-ownership.html>).

Only the role with the OWNERSHIP privilege on the user, or a higher role, can execute this command to modify most user properties.

To grant ownership permissions, use the following command:

```text
GRANT OWNERSHIP ON USER "UserName" TO ROLE "Rolename";
```

Where `UserName` refers to the name of the user that you are modifying.

> [!NOTE]
>
> To modify, enable, disable, unlock, or change the password of a user, a minimum permission user assigned role should have ownership permission on the user who you are modifying.

### Activity Insights Permissions

Ensure the administrator has all the permissions as mentioned in [Required Permissions](<#required-permissions>) including the following additional permission to utilize the Activity Insights.

**Additional Permission**

Role that encapsulates the `SYSADMIN` and `SECURITYADMIN` system-defined roles. It is the top-level role in the system and should be granted only to a limited/controlled number of users in your account. To grant additional permission, use the following command:

```text
GRANT ROLE ACCOUNTADMIN TO USER "UserName";
```

For more information on configuring Activity Insights, refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/connecting.html#activity-insights-settings>).

# Machine Account Attributes

## Machine Account Provisioning Attributes

The following list contains the fields used in machine account creation.

> [!NOTE]
>
> Parameters marked with an asterisk (\*) are mandatory.

| Field (Name) | Type | Required | Initial Value / Mapping | Allowed Values / Notes |
| --- | --- | --- | --- | --- |
| name\* | string | Yes | Static: Enter unique username. | Set this to a unique Snowflake username for machine account creation. |
| email\* | string | Yes | Disable (no default transform in template) | Provide this value at request time. |
| display\_name\* | string | Yes | Disable (no default transform in template) | Provide this value at request time. |
| login\_name | string | No | Disable | Use this when the login name differs from `name`. |
| type\* | string | Yes | Static: SERVICE | machine-account indicator used by classification criteria. |
| disabled | boolean | No | Disable | Account state flag. |
| default\_warehouse | string | No | Disable | Default warehouse assignment. |
| default\_role | string | No | Disable | Default role assignment. |
| default\_secondary\_roles | string | No | Disable | Default secondary role behavior. |

For additional details about machine account implementation, refer to the [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html#implementing-without-application-data>).

### Classification

The Classification attribute is used to identify and categorize the account as a Machine Account.

Attribute name : type

Value : SERVICE / LEGACY\_SERVICE / SNOWFLAKE\_SERVICE

For additional details about machine account classification, refer to [Classifying Machine Accounts](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#classifying-machine-accounts>).

# Provisioning

The Snowflake SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Snowflake directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

The following generators create the required information for a new Snowflake SaaS account:

| Account Attribute | Mapping Type | Description |
| --- | --- | --- |
| name\* | Identity Attribute | Identifier for the user; must be unique for your account. |
| type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. |
| password | Generator | User's password.<br>The default Generator is **Create Password**. |
| first\_name | Identity Attribute | User's first name. |
| last\_name | Identity Attribute | User's first, middle, and last name. |
| login\_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display\_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. |
| email | Identity Attribute | User's email address. |
| must\_change\_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| disabled | Disable | Specifies whether the user is disabled, which prevents the following actions:<br>For new users, the user is locked out of Snowflake and cannot log in.<br>For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| default\_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default\_role | Disable | Specifies the primary role that is active by default for the user's session upon login. |
| default\_secondary\_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. |

> [!NOTE]
>
> Parameters marked with an asterisk (\*) are mandatory.

### Update Account Attributes

| Account Attribute | Mapping Type | Description |
| --- | --- | --- |
| password | Generator | User's password.<br>The default Generator is **Create Password**. |
| type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. |
| first\_name | Identity Attribute | User's first name. |
| last\_name | Identity Attribute | User's first, middle, and last name. |
| login\_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display\_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. |
| email | Identity Attribute | User's email address. |
| must\_change\_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| disabled | Disable | Specifies whether the user is disabled, which prevents the following actions:<br>For new users, the user is locked out of Snowflake and cannot log in.<br>For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| default\_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default\_role | Disable | Specifies the primary role that is active by default for the user's session upon login. |
| default\_secondary\_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. |

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Snowflake SaaS connector uses the following default correlation and object configurations.

For Snowflake Cortex agent and capability resource schemas collected through Dataset Management, refer to [Supported Resources](<https://documentation.sailpoint.com/connectors/snowflake/saas/help/datasets.html#supported-resources>).

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the Snowflake SaaS source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| email | Equals | Work Email |
| display\_name | Equals | Name |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| name | Account |
| name | Group |

> [!CAUTION]
>
> The `name` attribute is an Account ID / Entitlement ID, don't change the value of `name` of the user/role from Snowflake system after aggregation, this can lead to issues with your integration.

### Default Account Attributes

The Snowflake SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| name | Name of the user. |
| type | Specifies the type of user. This property is used to differentiate between human and machine users. |
| login\_name | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display\_name | Name displayed for the user in the Snowflake web interface. |
| first\_name | First name of the user. |
| last\_name | First, middle, and last name of the user. |
| email | Email address of the user. |
| days\_to\_expiry | Specifies the number of days after which the user status is set to Expired and the user is no longer allowed to log in. |
| comment | Specifies a comment for the user. |
| disabled | Specifies whether the user is disabled, which prevents the following actions:<br>For new users, the user is locked out of Snowflake and cannot log in.<br>For existing users, setting the property aborts all their currently running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| must\_change\_password | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| snowflake\_lock | The user's lock/unlocked status in Snowflake. |
| default\_warehouse | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default\_namespace | Specifies the namespace (database only or database and schema) that is active by default for the user's session upon login. |
| default\_role | Specifies the primary role that is active by default for the user's session upon login. |
| databaseRoles | List of database roles assigned to the user |
| default\_secondary\_roles | Specifies the set of secondary roles that are active for the user's session upon login. |
| owner | Owner role of the user's account. |
| roles | All roles directly assigned to the user. |
| has\_password | Specifies whether the user has a password set. Type: Boolean |
| has\_rsa\_public\_key | Specifies whether the user has an RSA public key set for key-pair authentication. Type: Boolean |
| has\_mfa | Specifies whether the user is enrolled in multi-factor authentication (MFA). Type: Boolean |
| ext\_authn\_duo | Specifies whether Duo Security is enabled as the second factor of authentication for the user. Type: Boolean |
| authenticationMethod | Specifies how the user can authenticate. This value is derived from `has_password`, `has_rsa_public_key`, `has_mfa`, and `ext_authn_duo`. The first matching value is used:<br>Type: String<br>`KEY_PAIR` - The user has an RSA public key. This value is used even if the user also has a password.<br>`USER_PASS_DUO_MFA` - The user has a password and is enrolled in MFA (`has_mfa` or `ext_authn_duo` is true). This value applies when the user is enrolled in MFA, including methods other than Duo.<br>`USER_PASS_NO_MFA` - The user has a password and is not enrolled in MFA.<br>`NONE` - The user has neither a password nor an RSA public key. These users, for example service users, might still authenticate through OAuth, a programmatic access token, or workload identity federation. |

#### Configurable Account Attributes

The following is a list of attributes that are not provided out-of-the-box. You can add them to your schema to view various Snowflake user information.

| Attribute Name | Description |
| --- | --- |
| locked\_until\_time | Timestamp indicating the user locked end time. The user remains locked until this time. |
| expires\_at\_time | Timestamp indicating time when user expires. |
| last\_success\_login | Timestamp indicating time of user's last successful login on Snowflake. |
| mins\_to\_unlock | Specifies the number of minutes until the temporary lock on the user login is cleared. |
| created\_on | Timestamp indicating time when user was created. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Role Attributes

The Snowflake SaaS connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.

The Role group schema contains the following attributes by default.

| Attribute Name | Description |
| --- | --- |
| name | Role's unique identifier name |
| is\_default | Indicates if the role is a default entitlement for any user |
| is\_current | Indicates if the role is a current entitlement for any user |
| is\_inherited | Indicates if the role is inherited by another entitlement |
| owner | Owner of the role |
| comment | Specifies a comment for the role |
| roles | List of inherited roles |
| databaseRoles | List of child database roles assigned to the role |
| privileges | Direct privileges assigned to the role |

#### Default Database Attributes

The Database Role group schema contains the following attributes by default.

| Attribute Name | Description |
| --- | --- |
| name | The Database Role's name |
| is\_default | Indicates if the database role is a default database role |
| is\_current | Indicates if the database role is a current role |
| is\_inherited | Indicates if the database role is inherited by another database role |
| owner | Owner of the database role |
| comment | Comment for the database role |
| databaseRoles | List of child database roles assigned to the role |
| privileges | Direct privileges assigned to the database role |

#### Default Configurable Attributes

The following is a list of attributes that are not provided out of the box. You can add them to your schema to view various Snowflake user information.

| Attribute Name | Description |
| --- | --- |
| created\_on | Timestamp indicating time when role was created. |

## Default Machine Identity Attributes

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>).

The following list contains the default machine identity schema attributes. The attributes must be defined as strings if not otherwise specified.

| Attribute Name | Description |
| --- | --- |
| created\_on | Timestamp for when the agent was created |
| name | Name of the agent |
| database\_name | Database containing the agent |
| schema\_name | Schema containing the agent |
| owner | Owner role of the agent |
| comment | Comment text for the agent |
| profile | Agent profile JSON (display\_name, avatar, color) |
| roles | List of Snowflake roles that have direct privileges on this agent, derived from Snowflake grants. For example, `USAGE`, `MONITOR`, `OWNERSHIP` |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Provisioning Operations Fail for the PUBLIC Role

**Issue**: During Add or Remove entitlement processes, if a role is identified as `PUBLIC`, the connector throws an exception and marks the item as failed.

**Resolution**: No actions are necessary. Operations involving the `PUBLIC` role have no impact on the Snowflake-managed system. The `PUBLIC` role is a mandatory default role granted to all users and cannot be revoked.

## Entitlement Aggregation Fails With Runtime Exception Payload Is Larger Than Max Message Size

**Issue**: Entitlement aggregation processes fail with the following error message:

```text
java.lang.RuntimeException: An error occurred while aggregating Application Snowflake SaaS [source] [ConnectorError] payload is larger than max message size 16777216, payload size 20909438
```

**Resolution**: Remove the `roles` and `privileges` attributes from the `group` schema and retry the aggregation process.