Lock down Snowflake login by combining a network policy (IP/network-rule allow-listing) with an authentication policy requiring MFA

Documented steps

1. As SECURITYADMIN (or a role with CREATE NETWORK RULE), create ingress network rules: `CREATE NETWORK RULE my_rule MODE = INGRESS TYPE = IPV4 VALUE_LIST = ('1.2.3.4/32');` IPv6 is supported only via network rules, not the legacy IP-list properties.
2. Create the network policy: `CREATE NETWORK POLICY my_policy ALLOWED_NETWORK_RULE_LIST = ('my_rule') BLOCKED_NETWORK_RULE_LIST = (...);` Legacy ALLOWED_IP_LIST/BLOCKED_IP_LIST properties still work, but Snowflake recommends network rules.
3. Confirm your own current egress IP is inside the allowed list BEFORE activating — activating a policy that excludes you locks out the session applying it.
4. Activate account-wide with `ALTER ACCOUNT SET NETWORK_POLICY = my_policy;`, or scope to a user with `ALTER USER joe SET NETWORK_POLICY = my_policy;` (requires OWNERSHIP on the user plus USAGE on the policy).
5. Create an authentication policy, e.g. `CREATE AUTHENTICATION POLICY my_auth_policy AUTHENTICATION_METHODS = ('PASSWORD','SAML') CLIENT_TYPES = ('SNOWFLAKE_UI','DRIVERS') MFA_ENROLLMENT = 'REQUIRED' MFA_POLICY = (ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION = 'ALL');` See CREATE AUTHENTICATION POLICY for the full value list for each property.
6. If you set MFA_ENROLLMENT, CLIENT_TYPES must include SNOWFLAKE_UI, because Snowsight is the only place users can enroll in MFA.
7. Attach it: `ALTER ACCOUNT SET AUTHENTICATION POLICY my_auth_policy;` or `ALTER USER <user> SET AUTHENTICATION POLICY my_auth_policy;` Attaching requires APPLY AUTHENTICATION POLICY or OWNERSHIP of the policy.
8. Verify with `SHOW NETWORK POLICIES;`, `DESCRIBE NETWORK POLICY my_policy;`, `SHOW AUTHENTICATION POLICIES IN ACCOUNT;`, `DESCRIBE AUTHENTICATION POLICY my_auth_policy;`, and `SHOW AUTHENTICATION POLICIES ON USER <user>;`.
9. Have users enroll in MFA via Snowsight using a passkey, an authenticator app (TOTP), or Duo.
10. Official documentation: https://docs.snowflake.com/en/user-guide/authentication-policies | https://docs.snowflake.com/en/sql-reference/sql/create-authentication-policy | https://docs.snowflake.com/en/user-guide/network-policies | https://docs.snowflake.com/en/sql-reference/sql/create-network-policy