Meeting Title: Snowflake User Provisioning Setup Discussion Date: 2026-04-07 Meeting participants: Ian Lamiano, Uttam Kumaran
WEBVTT
1 00:07:56.440 ⇒ 00:07:57.320 Uttam Kumaran: Hi, Ian.
2 00:07:58.410 ⇒ 00:07:59.270 Ian Lamiano: Hey!
3 00:07:59.270 ⇒ 00:08:00.430 Uttam Kumaran: Hey, how are you?
4 00:08:00.430 ⇒ 00:08:01.949 Ian Lamiano: I’m doing alright, how are you doing?
5 00:08:02.180 ⇒ 00:08:04.149 Uttam Kumaran: Good, nice to meet you, finally.
6 00:08:04.150 ⇒ 00:08:06.039 Ian Lamiano: Yeah, you too.
7 00:08:06.910 ⇒ 00:08:13.810 Ian Lamiano: Yeah, and I, so I got brought into this channel, I think, a little bit late,
8 00:08:13.930 ⇒ 00:08:18.130 Ian Lamiano: So I’m actually not entirely sure what… We need to do.
9 00:08:18.600 ⇒ 00:08:21.079 Ian Lamiano: I was hoping you could kind of catch me up.
10 00:08:21.080 ⇒ 00:08:36.929 Uttam Kumaran: Definitely. Definitely. So yeah, I mean, maybe I’ll give you just a brief on the project. So, we’re basically standing up Snowflake as our, like, sort of data source of truth, ingesting a lot of data to the channel, starting to onboard users to actually
11 00:08:37.020 ⇒ 00:08:47.770 Uttam Kumaran: use Snowflake and some of the AI capabilities. Of course, we want to just confirm, like, how people are actually getting, how people are actually getting,
12 00:08:48.040 ⇒ 00:09:04.689 Uttam Kumaran: access to Snowflake, and Catherine mentioned a few methods of, like, user provisioning, and really what I wanted to talk to you about is a little bit learn of, like, what it looks like on your side to automatically, or on request, provision access to Snowflake, and give you some of the default roles and
13 00:09:05.020 ⇒ 00:09:12.349 Uttam Kumaran: warehouses and things, so that people are sort of set up immediately. That’s really, like, the impetus for this conversation.
14 00:09:12.600 ⇒ 00:09:19.460 Ian Lamiano: Okay, okay. Yeah, and I know Catherine and I talked about that, I think, last week, or…
15 00:09:19.990 ⇒ 00:09:21.710 Ian Lamiano: Jeez, maybe it was 2 weeks ago now.
16 00:09:21.890 ⇒ 00:09:25.820 Ian Lamiano: Because I know… you know, I didn’t set up
17 00:09:27.100 ⇒ 00:09:30.649 Ian Lamiano: Snowflake and Okta, which is how we currently have.
18 00:09:30.650 ⇒ 00:09:31.240 Uttam Kumaran: Yes.
19 00:09:32.230 ⇒ 00:09:37.180 Ian Lamiano: I think there were some, like, there was some confusion about how that should work.
20 00:09:37.570 ⇒ 00:09:43.280 Ian Lamiano: I can definitely… show you how it’s currently set up, but,
21 00:09:43.280 ⇒ 00:09:43.870 Uttam Kumaran: Okay.
22 00:09:44.800 ⇒ 00:09:52.700 Uttam Kumaran: That’s… yeah, if you can show me how it’s currently set up, and, like, if there’s any docs, then I can basically give you the…
23 00:09:52.990 ⇒ 00:09:57.319 Uttam Kumaran: the setup we’d prefer, and… Sure. Yeah, that would be super helpful.
24 00:09:57.640 ⇒ 00:10:03.279 Ian Lamiano: Yeah, let’s see if I can… Share the screen…
25 00:10:04.890 ⇒ 00:10:06.689 Ian Lamiano: Okay, can you see my screen?
26 00:10:07.180 ⇒ 00:10:07.990 Uttam Kumaran: Yes.
27 00:10:07.990 ⇒ 00:10:08.530 Ian Lamiano: Cool.
28 00:10:10.380 ⇒ 00:10:16.859 Ian Lamiano: So… So I know I got set up with… Production in a sandbox.
29 00:10:17.650 ⇒ 00:10:22.730 Ian Lamiano: Let’s see, maybe we’ll…
30 00:10:27.290 ⇒ 00:10:32.080 Ian Lamiano: So I think… We’ve got some push groups going on.
31 00:10:33.290 ⇒ 00:10:38.269 Ian Lamiano: for… I think these are all roles in Snowflake?
32 00:10:40.270 ⇒ 00:10:43.200 Uttam Kumaran: Yes, those are. So…
33 00:10:45.060 ⇒ 00:10:55.500 Uttam Kumaran: Yes, those are roles. So I guess this is the first time I’ve actually seen the Okta admin side, so I’m just also getting… getting a little bit oriented, so…
34 00:10:55.670 ⇒ 00:10:59.870 Uttam Kumaran: what… so, what am I looking at here, exactly?
35 00:10:59.870 ⇒ 00:11:03.279 Ian Lamiano: Sure. Yeah, yeah, yeah, so… This is,
36 00:11:03.770 ⇒ 00:11:13.070 Ian Lamiano: So on this side, these are all groups that are in Okta specifically, and… I think that they…
37 00:11:13.790 ⇒ 00:11:18.639 Ian Lamiano: these are groups in Snowflake, and I think that these groups pushed And created these?
38 00:11:18.920 ⇒ 00:11:22.950 Ian Lamiano: And so anyone that’s in this admin group
39 00:11:23.390 ⇒ 00:11:26.410 Ian Lamiano: should be in that admin group on the Snowflake side.
40 00:11:26.560 ⇒ 00:11:30.659 Ian Lamiano: Anyone in this analyst group should be on the analyst side as well.
41 00:11:31.160 ⇒ 00:11:35.330 Ian Lamiano: So this is just, like, the actual, like, I guess the provisioning groups.
42 00:11:35.880 ⇒ 00:11:36.980 Uttam Kumaran: Okay, okay.
43 00:11:37.380 ⇒ 00:11:44.069 Uttam Kumaran: So then, basically, when people request… when, like, let’s just take,
44 00:11:44.780 ⇒ 00:11:52.430 Uttam Kumaran: random employee ABC, like, when they come into Okta, is the flow, like, they request access to Snowflake, and then
45 00:11:52.830 ⇒ 00:11:59.309 Uttam Kumaran: you’re manually assigning one of these groups? Is that sort of, like, a good way to say it back?
46 00:12:00.360 ⇒ 00:12:04.460 Ian Lamiano: Kinda, I don’t wanna… Overcomplicated, because there is.
47 00:12:04.460 ⇒ 00:12:04.860 Uttam Kumaran: Okay.
48 00:12:04.860 ⇒ 00:12:08.950 Ian Lamiano: Different system for actually doing the request, but.
49 00:12:08.950 ⇒ 00:12:10.370 Uttam Kumaran: Yeah, is it Trellica?
50 00:12:10.370 ⇒ 00:12:13.599 Ian Lamiano: Yeah, yeah, yeah, yeah, Metropolica. But, like.
51 00:12:13.720 ⇒ 00:12:16.610 Ian Lamiano: That part is, like, a lot easier, because.
52 00:12:16.610 ⇒ 00:12:17.030 Uttam Kumaran: Okay.
53 00:12:17.030 ⇒ 00:12:19.000 Ian Lamiano: from the Trellica side,
54 00:12:19.720 ⇒ 00:12:25.149 Ian Lamiano: At least right now, it’s just pushing people into one of these groups, so, you know, it’s not manual.
55 00:12:25.940 ⇒ 00:12:30.589 Ian Lamiano: But I know there is, I think, another integration you can do between Trelloca and Snowflake.
56 00:12:32.290 ⇒ 00:12:34.350 Ian Lamiano: Maybe that’s something we should explore.
57 00:12:35.490 ⇒ 00:12:42.380 Uttam Kumaran: Yeah, I think the natural flow on my side is, like, yeah, I think someone at CTA is like, I would like access to Snowflake.
58 00:12:42.710 ⇒ 00:12:56.050 Uttam Kumaran: I think there’s just basically, like, two groups on our side. There’s, like, the data team and, like, admins, and then there’s, like, sort of, like, everyone else. We don’t really have a third yet.
59 00:12:56.220 ⇒ 00:13:00.830 Uttam Kumaran: So, ideally, like, those are the two flows, and most of the people are on the…
60 00:13:01.050 ⇒ 00:13:05.359 Uttam Kumaran: just, like, just the analyst side. Right. I have the… I have the…
61 00:13:05.620 ⇒ 00:13:16.310 Uttam Kumaran: basically, there’s some settings on Snowflake, like their default warehouse, their default roles, like, what are some of the mandatory fields? Like, if their name and their first name and last name could be there.
62 00:13:16.560 ⇒ 00:13:21.839 Uttam Kumaran: So, if that’s helpful for me to scope out, then ideally, actually, I think we could probably, like.
63 00:13:22.790 ⇒ 00:13:24.760 Uttam Kumaran: Split this into just two.
64 00:13:26.950 ⇒ 00:13:41.979 Uttam Kumaran: because I think we’re still gonna have some admins and some data people joining, and then really the other group is, like, everybody else. And then, also, let’s say we move from, like, an analyst to, like, an analyst plus with some additional functionality, I can make a request to you and say, here’s, like.
65 00:13:42.720 ⇒ 00:13:51.769 Uttam Kumaran: here’s how people should get in, but actually, once we’re in Snowflake, we can handle the changes, so it’s actually mainly for net new people.
66 00:13:51.870 ⇒ 00:13:56.460 Uttam Kumaran: Okay. That just makes it a little bit convenient, not like…
67 00:13:56.460 ⇒ 00:13:56.929 Ian Lamiano: Yes, yes.
68 00:13:56.930 ⇒ 00:13:57.630 Uttam Kumaran: Yeah, yeah.
69 00:13:57.630 ⇒ 00:13:59.930 Ian Lamiano: In that case, I guess that the…
70 00:14:01.260 ⇒ 00:14:08.500 Ian Lamiano: the way to do it, since I don’t think that these groups are actually assigning any roles, right? You’re all doing that on the Snowflake side?
71 00:14:08.650 ⇒ 00:14:10.110 Ian Lamiano: At least that’s my understanding.
72 00:14:10.410 ⇒ 00:14:14.099 Uttam Kumaran: Yeah, but there are default roles that we’d prefer.
73 00:14:14.340 ⇒ 00:14:27.229 Uttam Kumaran: Because otherwise, people are gonna get into Snowflake and then sort of see nothing, so I can give you the default role, and then if people transition roles once they’re in, we can handle that, that’s fine. And then it’s mainly just for when people get added to the system.
74 00:14:27.330 ⇒ 00:14:29.830 Uttam Kumaran: Yeah.
75 00:14:30.390 ⇒ 00:14:37.470 Ian Lamiano: Okay, cause… Yeah, I guess… so right now, it sounds like you’re saying…
76 00:14:38.430 ⇒ 00:14:44.169 Ian Lamiano: We’re just using the two groups, and really just two roles right now, but in the future, we might add a third.
77 00:14:44.740 ⇒ 00:14:45.270 Uttam Kumaran: Correct.
78 00:14:45.270 ⇒ 00:14:51.220 Ian Lamiano: So I think if we were to continue using this setup as is, I think I would just basically add a new octa group
79 00:14:51.810 ⇒ 00:14:56.979 Ian Lamiano: Which would then push to Snowflake, and then, you know, those new people would go in there.
80 00:14:57.140 ⇒ 00:15:00.929 Ian Lamiano: And then I guess you would just have, like, a default role in Snowflake, right, that would just be, like…
81 00:15:01.170 ⇒ 00:15:03.909 Ian Lamiano: I don’t know, read-only, or… I don’t know.
82 00:15:03.910 ⇒ 00:15:14.660 Uttam Kumaran: Yeah, so we have that. I guess on the Okta side, though, are you able to assign that default? Like, it’s not on… it’s not on creation, necessarily, it’s, like.
83 00:15:14.860 ⇒ 00:15:19.529 Uttam Kumaran: Well, it’s not… it’s not on the Snowflake side, it happens on the user creation.
84 00:15:19.670 ⇒ 00:15:20.440 Ian Lamiano: Really? Oh.
85 00:15:20.440 ⇒ 00:15:27.859 Uttam Kumaran: So, yeah, so it’s like, it’s not like you land, and then it, like, assigns you, it’s like, when you land, you do the assignment at the same time.
86 00:15:28.490 ⇒ 00:15:35.680 Ian Lamiano: Okay, my… so I don’t… My understanding was that, at least with this setup, was…
87 00:15:35.800 ⇒ 00:15:42.420 Ian Lamiano: not doing any role assignment. Like, that was all just based on the group that they end up in on the Snowflake side, so…
88 00:15:42.730 ⇒ 00:15:46.540 Ian Lamiano: you know, like, the Snowflake analyst group already has, like, whatever the role is.
89 00:15:47.340 ⇒ 00:15:52.430 Ian Lamiano: I don’t know that there’s a way… with this…
90 00:15:52.730 ⇒ 00:15:55.259 Ian Lamiano: Current setup to push a roll.
91 00:15:55.920 ⇒ 00:15:59.940 Uttam Kumaran: Oh, okay, so then this group… .
92 00:16:03.370 ⇒ 00:16:03.890 Ian Lamiano: Yeah, let me know.
93 00:16:03.890 ⇒ 00:16:04.640 Uttam Kumaran: group.
94 00:16:04.640 ⇒ 00:16:05.179 Ian Lamiano: Do you want to explore?
95 00:16:05.180 ⇒ 00:16:10.670 Uttam Kumaran: Yeah, yeah, yeah, maybe we can just explore, I can just see, like, if there’s any setting on the Snowflake side.
96 00:16:16.450 ⇒ 00:16:19.319 Ian Lamiano: Okay… I’m wondering…
97 00:16:29.560 ⇒ 00:16:36.910 Ian Lamiano: Okay, so this would be… So it’s not currently set, but it looks like we can use… default role.
98 00:16:39.100 ⇒ 00:16:41.419 Ian Lamiano: Although this is for…
99 00:16:56.740 ⇒ 00:16:58.419 Ian Lamiano: So I think I can do…
100 00:17:01.730 ⇒ 00:17:03.530 Ian Lamiano: I’ll have to explore that a little.
101 00:17:04.240 ⇒ 00:17:11.510 Ian Lamiano: But… Because I think this is for anyone that comes in,
102 00:17:12.160 ⇒ 00:17:14.790 Ian Lamiano: Rather than, like, a group-based role assignment.
103 00:17:14.790 ⇒ 00:17:24.269 Uttam Kumaran: Yeah, so this is exactly it. Oh, this is actually perfect. So exactly… you have first name, last name, email, display name. It’s actually this role and warehouse that…
104 00:17:24.599 ⇒ 00:17:27.519 Uttam Kumaran: I can give you the defaults for.
105 00:17:28.359 ⇒ 00:17:30.699 Ian Lamiano: Okay, but I think that’s gonna be for everybody.
106 00:17:30.979 ⇒ 00:17:31.659 Ian Lamiano: Is that alright?
107 00:17:31.660 ⇒ 00:17:33.699 Uttam Kumaran: But is… oh, is it for… so…
108 00:17:33.700 ⇒ 00:17:35.759 Ian Lamiano: Yeah, this is just for the application, like.
109 00:17:35.760 ⇒ 00:17:39.319 Uttam Kumaran: Oh, okay, so well, okay, so then here’s another alternative, like…
110 00:17:39.730 ⇒ 00:17:44.870 Uttam Kumaran: I think it’s fine to do it for everybody, and then I can… there’s gonna be fewer people that are admin, like.
111 00:17:45.270 ⇒ 00:17:55.029 Uttam Kumaran: Occasionally. So I can just do that on our side. If this is the best we can do, that’s totally fine. I’d rather just give people the default analyst role.
112 00:17:55.430 ⇒ 00:17:57.670 Uttam Kumaran: For now.
113 00:17:58.240 ⇒ 00:17:58.630 Ian Lamiano: Okay.
114 00:17:58.630 ⇒ 00:18:03.209 Uttam Kumaran: Like, whatever, like, the global role is, because otherwise, right now, people are going in, there’s, like, they don’t see anything.
115 00:18:05.560 ⇒ 00:18:10.720 Uttam Kumaran: Well, like, they see Snowflake, but, like, you don’t get access to anything, like, any of the core functionality.
116 00:18:11.430 ⇒ 00:18:12.250 Ian Lamiano: Okay.
117 00:18:15.590 ⇒ 00:18:16.519 Ian Lamiano: Alright, let’s just…
118 00:18:16.520 ⇒ 00:18:19.070 Uttam Kumaran: So I can… yeah, let me… I can just tell you what these are.
119 00:18:20.870 ⇒ 00:18:22.590 Ian Lamiano: Alright, yeah, let’s.
120 00:18:23.420 ⇒ 00:18:29.170 Uttam Kumaran: That’d be… I mean, that’s fine too, like, I… I’m just sort of like, what does Okta allow us to do?
121 00:18:29.170 ⇒ 00:18:30.250 Ian Lamiano: Yeah, yeah.
122 00:18:32.140 ⇒ 00:18:33.590 Uttam Kumaran: This is cool, yeah.
123 00:18:35.040 ⇒ 00:18:39.060 Ian Lamiano: Let’s see what we can do… Where’s my…
124 00:18:52.710 ⇒ 00:18:53.600 Ian Lamiano: Okay.
125 00:18:54.560 ⇒ 00:18:57.970 Ian Lamiano: If you want to put Like, if you…
126 00:19:03.190 ⇒ 00:19:06.819 Ian Lamiano: If you want to try putting one of the rolls in here, I’m not sure… I might wanna…
127 00:19:07.390 ⇒ 00:19:10.399 Ian Lamiano: I might want to look at this a little bit more, because I’m worried about.
128 00:19:11.360 ⇒ 00:19:22.309 Uttam Kumaran: I can… okay, that’s totally fine. I can just give you the role and warehouse that we’d prefer people to land in, and then, I mean, totally game to continue to test, or…
129 00:19:22.480 ⇒ 00:19:25.330 Uttam Kumaran: So I can just send… I can send you those in Slack.
130 00:19:25.730 ⇒ 00:19:27.160 Ian Lamiano: Okay, yeah, that works.
131 00:19:28.480 ⇒ 00:19:29.570 Uttam Kumaran: Okay, perfect.
132 00:19:29.720 ⇒ 00:19:36.149 Uttam Kumaran: Yeah, I mean, I don’t know if there’s… is there… can I… do you mind if there’s any other Snowflake-specific settings, just for my awareness here?
133 00:19:36.150 ⇒ 00:19:43.209 Ian Lamiano: Yeah, let’s, let’s look around. So, I mean, there’s… these are all the two Snowflake from Okta, these are all the…
134 00:19:43.530 ⇒ 00:19:46.590 Ian Lamiano: Reverse direction… Okay.
135 00:19:48.690 ⇒ 00:19:53.219 Uttam Kumaran: Okay, this is importing… okay, single sign-on. Yeah, if you could just go to the top, so…
136 00:19:53.440 ⇒ 00:19:58.180 Uttam Kumaran: Map, map, okay, this is… this makes sense.
137 00:19:58.360 ⇒ 00:20:02.909 Uttam Kumaran: Yeah, this is all the SSO set up directly and stuff, like, great. It’s, like, all automatic.
138 00:20:12.660 ⇒ 00:20:13.960 Uttam Kumaran: Cool, okay.
139 00:20:15.540 ⇒ 00:20:16.350 Uttam Kumaran: Right.
140 00:20:18.930 ⇒ 00:20:20.140 Ian Lamiano: You know what?
141 00:20:20.760 ⇒ 00:20:21.550 Uttam Kumaran: Oh!
142 00:20:21.550 ⇒ 00:20:22.770 Ian Lamiano: So you can do it by group.
143 00:20:23.500 ⇒ 00:20:27.049 Uttam Kumaran: attributes of set… threshold set by mappings? Oh, okay.
144 00:20:27.680 ⇒ 00:20:31.299 Uttam Kumaran: Alright, I mean, that’s… that’s, that’s perfect.
145 00:20:31.300 ⇒ 00:20:31.640 Ian Lamiano: Yeah.
146 00:20:31.640 ⇒ 00:20:37.030 Uttam Kumaran: So you can do assignments by group. Okay, then I can just… what I can do is I will send you
147 00:20:37.600 ⇒ 00:20:43.729 Uttam Kumaran: the role warehouse for both the groups, and then I’ll just make sure that’s in our documentation.
148 00:20:43.890 ⇒ 00:20:49.170 Uttam Kumaran: And then… we’re not in a huge rush on this, just something as part of our rollout plan that we wanted to nail down.
149 00:20:49.170 ⇒ 00:20:50.899 Ian Lamiano: Yeah, yeah, yeah,
150 00:20:51.230 ⇒ 00:20:57.980 Ian Lamiano: Yeah, send me those, I’ll try setting it up, and then maybe I’ll add, like, a test user, just to make sure that they come through.
151 00:21:00.910 ⇒ 00:21:07.360 Ian Lamiano: And then, if that works, then I’ll update Trelica so that people can just request it, and then it’ll be hands-off.
152 00:21:08.870 ⇒ 00:21:09.530 Uttam Kumaran: Okay.
153 00:21:09.840 ⇒ 00:21:10.200 Ian Lamiano: Cool.
154 00:21:10.200 ⇒ 00:21:15.809 Uttam Kumaran: Perfect. And then our other question, and I don’t know where Catherine and I arrived, but there is a Snowflake sandbox.
155 00:21:16.000 ⇒ 00:21:19.089 Uttam Kumaran: That we wanted to dis- we wanted to disable
156 00:21:19.420 ⇒ 00:21:28.659 Uttam Kumaran: Because I don’t think anyone is using it anymore. So maybe I can just ping her really quickly to get the confirmation. Okay. And then we can turn this one off.
157 00:21:29.000 ⇒ 00:21:30.020 Uttam Kumaran: Also? Yep.
158 00:21:30.660 ⇒ 00:21:31.059 Ian Lamiano: Yeah, yeah, yeah.
159 00:21:31.060 ⇒ 00:21:39.460 Uttam Kumaran: Okay, so let me… let me… let me do… so let me do both those things. I’ll get you the role warehouse for both the groups, and then I’ll just quickly confirm with Catherine in the channel that we can…
160 00:21:39.820 ⇒ 00:21:45.290 Uttam Kumaran: turn off this, this one. And so, I guess the question, in turning this off.
161 00:21:46.050 ⇒ 00:21:51.789 Uttam Kumaran: it turns off the box there, but then does it disable… I assume it disables…
162 00:21:52.050 ⇒ 00:22:08.609 Uttam Kumaran: you using SSO to log into this. So, I should just double check that, like, okay, so the… I’ll just message her, double check that there’s, like, nothing else in here, or, like, maybe on our side, how do I, like, bring it down on Snowflake, and then we can turn this off. Some people just have two right now, and we just want to direct them to that one.
163 00:22:08.850 ⇒ 00:22:15.600 Ian Lamiano: Yeah, yeah, yeah, yeah. And I’m guessing it will disable SSO, but also deprovision. I think that’s…
164 00:22:16.550 ⇒ 00:22:17.220 Ian Lamiano: Yeah, it’ll.
165 00:22:17.220 ⇒ 00:22:30.280 Uttam Kumaran: Exactly, so, yeah, exactly. So I can… so I’ll go look and see. First step is, like, what do I need to do on our side to just, like, bring this down? And then I think, yeah, we can deprovision and disable.
166 00:22:30.460 ⇒ 00:22:30.970 Ian Lamiano: Okay.
167 00:22:32.070 ⇒ 00:22:32.710 Ian Lamiano: Cool.
168 00:22:32.710 ⇒ 00:22:44.339 Uttam Kumaran: Okay, perfect. Thank you. This was really, really helpful. I’ve never seen, like, Okta from the admin side, so that’s pretty cool. It’s kind of similar, like, we do a lot of role-based access control on the data side, so I feel like…
169 00:22:44.340 ⇒ 00:22:45.409 Ian Lamiano: Different coat of paint.
170 00:22:45.650 ⇒ 00:22:48.349 Uttam Kumaran: Yes, exactly, exactly.
171 00:22:48.350 ⇒ 00:22:51.540 Ian Lamiano: Cool. Well, yeah, I appreciate, you taking the time to jump on this.
172 00:22:51.670 ⇒ 00:22:55.670 Uttam Kumaran: No, thank you so much. Okay, cool. I’ll just Slack you, briefly, so I appreciate it.
173 00:22:55.670 ⇒ 00:22:56.850 Ian Lamiano: Alright, sounds good. Thanks.
174 00:22:56.850 ⇒ 00:22:57.839 Uttam Kumaran: Okay, thank you, bye.