Setting Up Multi-Factor Authentication (MFA) for Snowflake

Multi-Factor Authentication (MFA) adds an extra layer of security to your Snowflake account by requiring a second form of verification beyond just your password. This means even if someone gets hold of your password, they still can't access your account without your phone or authentication device. This guide shows you how to set this up.

Why Use Multi-Factor Authentication (MFA)?

MFA significantly reduces the risk of unauthorised access to your Snowflake account:

• Protection against password theft: Even if your password is compromised, attackers can't get in without your second factor
• Compliance requirements: Many organisations require MFA for accessing sensitive data
• Peace of mind: You'll get notifications of login attempts, so you'll know if someone's trying to access your account
• Industry standard: MFA is becoming a baseline security requirement across most platforms

Am I required to use MFA?

Snowflake is rolling out enforced MFA across accounts, at which point MFA for password users become mandatory. Check the Snowflake documentation on MFA enforcement for the timeline - all existing BI Connector accounts will be migrated to using MFA by October 2026.

Snowflake provides various second factors, including those below. You can choose which to use and which to set as your default:

• Authenticating with a passkey 
• Authenticating with an authenticator app

Using Programmatic Access Tokens

If you'd like to use Programmatic Access Tokens to reduce the number of authorisation requests, you can view our setup article: Using a Programmatic Access Token (PAT) as your BI Connector Credentials

Setting up MFA with an Authenticator App

What You'll Need

Before you start:

• Your Snowflake account credentials
• A smartphone or tablet
• An authenticator app (examples are Duo Mobile, Google Authenticator, or Microsoft Authenticator)

Step 1: Install an Authenticator App

If you don't already have one, download an authenticator app to your phone such as:

• Duo Mobile (recommended by Snowflake)
• Google Authenticator
• Microsoft Authenticator

Any standard TOTP (Time-based One-Time Password) authenticator will work.
 

Step 2: Log into Snowflake

Head to your Snowflake account at arbor-education.snowflakecomputing.com through the web interface and sign in with your BI Connector credentials.

Step 3: Access Your Profile Settings

Click on your username in the bottom-left corner, then select Settings from the menu.

Step 4: Navigate to Security Settings

From the left-menu choose Authentication
 

Step 5: Enable MFA

Under the Multi-factor authentication click Add new authentication method

Follow the prompts to configure your authentication method of choice.

Step 6: Save Your Backup Codes

Snowflake will provide you with backup codes. Save these somewhere secure - you'll need them if you lose access to your authenticator app. 

Setting up MFA with a Passkey

What You'll Need

Before you start:

• Your Snowflake account credentials
• A smartphone or tablet
• A method to store your passkey.
   

Step 1: Log into Snowflake

Head to your Snowflake account at arbor-education.snowflakecomputing.com through the web interface and sign in with your BI Connector credentials.

Step 2: Access Your Profile Settings

Click on your username in the bottom-left corner, then select Settings from the menu.

Step 3: Navigate to Security Settings

From the left-menu choose Authentication
 

Step 4: Enable MFA

Under the Multi-factor authentication click Add new authentication method

Follow the prompts to configure your authentication method of choice and store your passkey as you would with any other website or application.
 

Logging in with MFA

Using an Authenticator

When you log into Snowflake:

1. Enter your username and password as usual
2. Open your authenticator app
3. Enter the 6-digit code displayed for your Snowflake account
4. Click "Verify and Sign In"

The codes change every 30 seconds, so make sure you enter them before they expire.

Using a Passkey

When you log into Snowflake:

1. Enter your username and password as usual
2. Provide your Passkey when prompted

Updating your BI Tool

Depending on the type of MFA you have enabled your login method for your BI Tool (like Google Data Studio or Power BI) will change. Please update those details to ensure you have continued access to your dashboards.

You can use Passkeys, an Authenticator app or a Programmatic Access Token for this.

Troubleshooting

Lost your phone? 

Use one of your backup codes to log in, then set up MFA again with a new device.
 

Code not working? 

Check that:

• Your phone's time is set to automatic (authenticator apps rely on accurate time)
• You're entering the code before it expires
• You're looking at the right account in your authenticator app
   

Need to switch devices? 

Disable MFA in your security settings, then re-enable it and scan the QR code with your new device.
 

Can't access your account at all? 

Contact Arbor or your support partner to request a reset of MFA for your account.