SnowPro Core free question 4 / 10 · Domain 2: Account Management and Data Governance
By default, is MFA required for users who authenticate with single sign-on (SSO)?
- No, because SSO cannot be used together with MFA in an account
- No, Snowflake does not require MFA for SSO users by default
- Yes, SSO users are switched to password authentication first
- Yes, Snowflake requires MFA for SSO users by default
Show the answer and explanation
Answer: B
Why this is correct
By default, Snowflake does not require MFA for users who authenticate with single sign-on. Snowflake relies on the identity provider (IdP) to enforce MFA or some other strong authentication method.
Why the other options are wrong
"Yes, Snowflake requires MFA for SSO users by default" … MFA is not required for SSO users by default.
"No, because SSO cannot be used together with MFA in an account" … SSO works in Snowflake, and MFA can additionally be required for SSO users through an authentication policy.
"Yes, SSO users are switched to password authentication first" … SSO users are not switched to password sign-in.
Key point
To harden authentication for SSO users, use an authentication policy that requires them to enroll in and use Snowflake MFA after authenticating with the IdP. The policy uses properties such as MFA_ENROLLMENT and MFA_POLICY.
Go to the SnowPro Core practice app (10 free questions; purchase unlocks all questions)