# Snowflake MFA Setup: Enabling & Disabling

URL: https://select.dev/docs/resources/snowflake-developer-guide/snowflake-mfa
Index of all SELECT docs: https://select.dev/docs/llms.txt

> In this post, Ian explains how to enable MFA in your Snowflake account, and how account admins can disable it for a given user.

Multi-factor authentication (MFA) can be used for free by all Snowflake customers to provide increased security when connecting to Snowflake. Let's talk about how you can get setup with MFA in Snowflake.

## How to enable MFA for a Snowflake User?

To enable MFA for your Snowflake user, click on your profile in the Snowsight UI:

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/snowflake-mfa-0-eb999c632e20d9f9a894836b7c1b15315ba5b6237b16ec8b8c992f83d850a759/width=2352,quality=75)

At the bottom of your profile card, you'll see a section for **Multi-factor authentication**. Click the **Enroll** button:

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/snowflake-mfa-1-086d99204c290ae4c454d67a42b259939f56e43508217259d3b1f763c2583a2e/width=2334,quality=75)

Snowflake's MFA feature is powered by [Cisco Duo](https://duo.com/). You do not need to separately sign up for Duo, but you will need to download the [Duo Mobile Application](https://guide.duo.com/) on your phone.

Once enrolled, you'll see a [screen like this](https://docs.snowflake.com/en/user-guide/security-mfa#using-mfa-with-sf-web-interface) the next time you log in.

## How to disable MFA in Snowflake?

Disabling MFA can only be done programmatically with SQL by a user with the [ACCOUNTADMIN role](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles). Here's the command to disable MFA for a user:

```sql
use role accountadmin; alter user ian set disable_mfa=true;
```

## Is MFA enabled by default?

MFA is not enabled by default in Snowflake. It must be enabled on a per-user basis and users are not automatically enrolled in MFA. Administrators cannot automatically enforce that all users require MFA. They can instead build automations using the queries below to identify users without MFA and take the appropriate action.

## Identify all users without MFA enabled

To identify users without MFA enabled, you can query the `snowflake.account_usage.users` view (details [here](https://docs.snowflake.com/en/sql-reference/account-usage/users)).

```sql
select * from snowflake.account_usage.users where ext_authn_duo = false and deleted_on is null order by last_success_login desc ;
```

Note, this view can be up to 2 hours stale. For an up-to-date copy of the data, run the command `show users`.

The output of this query will likely contain many machine users, for which it doesn't make sense to enable MFA. Instead, it is recommended to setup [key-pair authentication](https://select.dev/docs/snowflake-developer-guide/snowflake-key-pair) for these users, instead of the traditional username-password authentication method.

## Identify all PRIVILEGED users without MFA

It's especially important to identify any users without MFA who have privileged access (one of the [default](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles) [`SYSADMIN`,](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles) [`SECURITYADMIN`, or](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles) [`ACCOUNTADMIN`](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles) [roles](https://select.dev/posts/snowflake-roles#default-snowflake-account-roles)), as a compromise of one of these users would be much more significant.

The following query identifies all users with access to one of these roles who do not have MFA enabled:

```sql
with 
privileged_roles (role_name) as (
    select grantee_name
    from snowflake.account_usage.grants_to_roles
    where
        privilege = 'MANAGE GRANTS'
        or grantee_name in ('SYSADMIN', 'SECURITYADMIN', 'ACCOUNTADMIN')
)
select
    users.name,
    users.has_password,
    timediff(days, users.last_success_login, current_timestamp())|| ' days ago' as last_login,
    timediff(days, users.password_last_set_time, current_timestamp(6)) || ' days ago' as password_age
from snowflake.account_usage.grants_to_users
inner join privileged_roles
    on grants_to_users.role = privileged_roles.role_name
    and grants_to_users.deleted_on is null
inner join snowflake.account_usage.users
    on grants_to_users.grantee_name = users.name
    and users.ext_authn_duo = false
    and users.deleted_on is null
order by users.last_success_login desc
;
```

## What other security measures should you implement?

In addition to enabling MFA for all human users in your Snowflake Account, consider the following additional security measures recommended by Snowflake:

- Use [key pair authentication](https://select.dev/docs/snowflake-developer-guide/snowflake-key-pair) for all users without MFA
- Rotate passwords frequently
- Utilize account-level Network Policies to only allow logins from known IP addresses for all users
- Utilize user-level Network to ensure service accounts can be only used from a more specific list of IP's
- Use Authentication Policies to ensure service accounts cannot use the UI
- Create a custom role for each service account and ensure least-privilege
- Consider using Session Policies and Password Policies
- Utilize a username naming convention to monitor all SQL closely and have a low threshold for suspicious activities