Snowflake Rolls Out Necessary MFA Plan

NEWS BRIEF

Snowflake has introduced a brand new authentication coverage that may require all clients to allow multifactor authentication (MFA) on their accounts by November 2025 or threat having their entry blocked.

The three-phase coverage change comes after Snowflake’s current resolution to allow MFA by default on all new accounts.

“MFA might be enforced by default for all human customers in any Snowflake account created as of October 2024,” Snowflake’s Anoosh Saboori and Brad Jones wrote again in September.

Within the first part, deliberate for April, human customers on accounts with no custom-made authentication coverage might be required to enroll in MFA the following time they signal into Snowflake.

The second part, in August, would require MFA for all password-based sign-ins for human customers. This requirement will apply no matter any customized authentication coverage in place on the account.

Within the closing part, Snowflake will block all password-based sign-in makes an attempt utilizing single-factor authentication. Whereas the earlier two phases centered on human customers, this part can even apply to service accounts utilizing programmatic entry.

Snowflake clients should make the mandatory adjustments earlier than November. Snowflake has created guides to assist organizations with the migration. There’s additionally a Risk Intelligence scanner package deal out there on Snowflake’s Belief Middle that may scan accounts to establish customers who shouldn’t have MFA enabled and are susceptible to shedding entry.

The spree of assaults focusing on Snowflake clients earlier this yr was a results of poor hygiene and the shortage of MFA. Greater than 165 organizations have been impacted, reminiscent of Neiman Marcus, Ticketmaster, and AT&T. A major quantity of buyer knowledge has been stolen, and several other victims have been hit with subsequent extortion makes an attempt.