What are Esri's recommendations to mitigate potential disruptions due to Snowflake's upcoming multi-factor authentication (MFA) enforcement?

Snowflake will block single-factor password authentication by May 2026 and enforce multi-factor authentication (MFA) on all human accounts. For more information on Snowflake’s MFA enforcement timeline, refer to this Snowflake documentation: Planning for the deprecation of single-factor password sign-ins. 

Users of ArcGIS Pro, ArcGIS Enterprise, and ArcGIS Data Pipelines (app in ArcGIS Online) who have integrated data from Snowflake using password-based accounts will be impacted when MFA is enabled. This article provides detailed information for each of these products and applications:

• ArcGIS Pro
• ArcGIS Enterprise
• ArcGIS Data Pipelines

ArcGIS Pro

ArcGIS Pro 3.1 and later releases can support connections to Snowflake that use basic authentication (username and password) with multi-factor authentication (MFA) enabled. 

Esri recommends taking the following steps to prevent repeated prompts for identity verification when MFA is enabled:

1. Enable MFA token caching in Snowflake for the user account. To enable MFA token caching in Snowflake, please refer to this Snowflake guide: Using MFA token caching to minimize the number of prompts during authentication.
2. In ArcGIS Pro, update database connections to add this additional property:
   AUTHENTICATOR = username_password_mfa
3. For existing ArcGIS Pro projects, layers referencing data in Snowflake will need to be updated to use the latest connection file (where the MFA caching property is set). Please refer to this documentation for Updating data sources in ArcGIS Pro. 

Additional information: The Additional Properties parameter of the database connection dialog was added in the ArcGIS Pro 3.1 release. If you are using ArcGIS Pro 3.0 or earlier, consider upgrading.

Beyond basic authentication using a username and password with MFA, ArcGIS Pro supports additional authentication types as well. ArcGIS Pro 3.5 introduces support for Snowflake’s key-pair authentication, providing an alternative option to using basic authentication or browser-based SSO.

Additionally, Snowflake added support for programmatic access tokens in April 2025 and describes them as a replacement for passwords. If a user connects to Snowflake from ArcGIS Pro (2.9 or later) and uses a programmatic access token as a password, MFA will not be triggered. Refer to the Snowflake documentation for more information on using a programmatic access token as a password to authenticate Snowflake in a third-party application such as ArcGIS Pro.

ArcGIS Enterprise

ArcGIS Enterprise 10.9.1 and later releases support connections to Snowflake using basic authentication (username and password). However, when Snowflake enforces multi-factor authentication (MFA) for all password-based sign-ins, these connections (data store items) will stop functioning. This is because web services, in general, do not support authentication types that require user interaction, such as MFA.

Option 1: Upgrade to ArcGIS Enterprise 11.5 and Use Key-Pair Authentication

Esri added support for Snowflake’s key-pair authentication in the Q2 2025 releases of ArcGIS Pro and ArcGIS Enterprise (3.5/11.5). Organizations should consider upgrading to ArcGIS Enterprise 11.5 and configuring Snowflake connections to use key-pair authentication. To ease the transition, ArcGIS Enterprise 11.5 allows users to update existing data store items to use key-pair authentication.

Option 2: Use a Programmatic Access Token as a Password with Basic Authentication

For organizations that cannot upgrade to ArcGIS Enterprise 11.5 or use key-pair authentication, Snowflake’s programmatic access tokens offer an alternative. Introduced in April 2025, programmatic access tokens are designed to replace passwords and do not trigger MFA when used with basic authentication (username and password).

To update Snowflake connections (data store items) in ArcGIS Enterprise 10.9.1 or later to use a programmatic access token, follow these steps:

1. Obtain a programmatic access token from your Snowflake administrator for the user account referenced by the data store item that is registered with ArcGIS Enterprise. For information on using programmatic access tokens as a replacement for a password, please refer to the Snowflake documentation: Using programmatic access tokens for authentication.
2. In ArcGIS Pro (2.9 or later), connect to Snowflake using user authentication. Use the same username that was originally used for the data store item but provide the programmatic access token in place of the password.
3. Verify that the connection works as expected.
4. Update the corresponding data store item in ArcGIS Enterprise using the new connection file (.sde). Follow the instructions for updating a database password in the ArcGIS Enterprise documentation.
5. Verify your web layers are functioning as expected. No service restart is required.

If no action is taken, and data store items in ArcGIS Enterprise referencing Snowflake are not updated to use either key-pair authentication or a programmatic access token, any web layers published from Snowflake will stop working once MFA is enforced.

For more information on Snowflake’s MFA enforcement timeline, please refer to this Snowflake documentation: Planning for the deprecation of single-factor password sign-ins.

ArcGIS Data Pipelines

When multi-factor authentication (MFA) is enforced on the user account, connections to Snowflake in ArcGIS Data Pipelines will stop functioning. 

In the ArcGIS Online update planned for Q2 2025, Esri will introduce support for Snowflake’s key-pair authentication, offering an alternative to user authentication (username and password). Users will be able to update their existing data store items in ArcGIS Online to switch from using user authentication to key-pair authentication, easing the transition.

For more information on Snowflake’s MFA enforcement timeline, please refer to this Snowflake documentation: Planning for the deprecation of single-factor password sign-ins.

This article will be updated as soon as new information is available.