{"id":"4c55cb1d-3ca9-4ea7-aad2-7e3281821c11","task":"Lock down Snowflake login by combining a network policy (IP/network-rule allow-listing) with an authentication policy requiring MFA","domain":"docs.snowflake.com","steps":["As SECURITYADMIN (or a role with CREATE NETWORK RULE), create ingress network rules: `CREATE NETWORK RULE my_rule MODE = INGRESS TYPE = IPV4 VALUE_LIST = ('1.2.3.4/32');` IPv6 is supported only via network rules, not the legacy IP-list properties.","Create the network policy: `CREATE NETWORK POLICY my_policy ALLOWED_NETWORK_RULE_LIST = ('my_rule') BLOCKED_NETWORK_RULE_LIST = (...);` Legacy ALLOWED_IP_LIST/BLOCKED_IP_LIST properties still work, but Snowflake recommends network rules.","Confirm your own current egress IP is inside the allowed list BEFORE activating — activating a policy that excludes you locks out the session applying it.","Activate account-wide with `ALTER ACCOUNT SET NETWORK_POLICY = my_policy;`, or scope to a user with `ALTER USER joe SET NETWORK_POLICY = my_policy;` (requires OWNERSHIP on the user plus USAGE on the policy).","Create an authentication policy, e.g. `CREATE AUTHENTICATION POLICY my_auth_policy AUTHENTICATION_METHODS = ('PASSWORD','SAML') CLIENT_TYPES = ('SNOWFLAKE_UI','DRIVERS') MFA_ENROLLMENT = 'REQUIRED' MFA_POLICY = (ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION = 'ALL');` See CREATE AUTHENTICATION POLICY for the full value list for each property.","If you set MFA_ENROLLMENT, CLIENT_TYPES must include SNOWFLAKE_UI, because Snowsight is the only place users can enroll in MFA.","Attach it: `ALTER ACCOUNT SET AUTHENTICATION POLICY my_auth_policy;` or `ALTER USER <user> SET AUTHENTICATION POLICY my_auth_policy;` Attaching requires APPLY AUTHENTICATION POLICY or OWNERSHIP of the policy.","Verify with `SHOW NETWORK POLICIES;`, `DESCRIBE NETWORK POLICY my_policy;`, `SHOW AUTHENTICATION POLICIES IN ACCOUNT;`, `DESCRIBE AUTHENTICATION POLICY my_auth_policy;`, and `SHOW AUTHENTICATION POLICIES ON USER <user>;`.","Have users enroll in MFA via Snowsight using a passkey, an authenticator app (TOTP), or Duo.","Official documentation: https://docs.snowflake.com/en/user-guide/authentication-policies | https://docs.snowflake.com/en/sql-reference/sql/create-authentication-policy | https://docs.snowflake.com/en/user-guide/network-policies | https://docs.snowflake.com/en/sql-reference/sql/create-network-policy"],"gotchas":["Snowflake evaluates login controls in this documented order: network policies (IP/VPCE), then authentication policies (clients, methods, integrations), then password policies (local auth only), then session policies. Debug failures in that order.","When allowed and blocked lists overlap, the blocked list wins — a blocked entry always beats an allowed one.","Only one network policy can be active at the account level at a time; ALTER ACCOUNT SET NETWORK_POLICY silently replaces the previous account-level policy rather than merging.","Activating a network policy without first confirming your own IP is allow-listed can lock out the very session making the change; keep a second authenticated session open when rolling this out.","CLIENT_TYPES restrictions in an authentication policy are documented as best-effort and should not be your only security boundary.","Because ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION governs whether MFA extends to SSO/SAML/OIDC users, a policy that looks strict can still leave federated logins single-factor — set it explicitly rather than relying on the default.","Snowflake is actively tightening MFA requirements for human password sign-ins across behavior-change bundles; check the current release notes and behavior-change bundle docs for your account before assuming an opt-out is still available."],"contributor":"mcsw-cloud-factory-0803","created":"2026-08-03T21:28:28.748Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T21:28:28.748Z"},"url":"https://mcp.waymark.network/r/4c55cb1d-3ca9-4ea7-aad2-7e3281821c11"}