What are Esri's recommendations to mitigate potential disruptions due to Snowflake's upcoming multi-factor authentication (MFA) enforcement?

Answer

Snowflake will block single-factor password authentication by November 2025 and enforce multi-factor authentication (MFA). This will happen using a phased approach, beginning in April 2025. For more information on Snowflake’s MFA enforcement timeline, and approaches to delay the enforcement of MFA on a password-based account, please refer to this Snowflake Knowledge Base article: FAQ: Snowflake Will Block Single-Factor Password Authentication by November 2025. 

Users of ArcGIS Pro, ArcGIS Enterprise, and ArcGIS Data Pipelines (app in ArcGIS Online) who have integrated data from Snowflake using password-based accounts will be impacted when MFA is enabled. This article provides detailed information for each of these products and applications:

• ArcGIS Pro
• ArcGIS Enterprise
• ArcGIS Data Pipelines

ArcGIS Pro

ArcGIS Pro 3.1 and later releases can support connections to Snowflake that use basic authentication (username and password) with multi-factor authentication (MFA) enabled. 

Esri recommends taking the following steps to prevent repeated prompts for identity verification when MFA is enabled:

1. Enable MFA token caching in Snowflake for the user account. To enable MFA token caching in Snowflake, please refer to this Snowflake guide: Using MFA token caching to minimize the number of prompts during authentication.
2. In ArcGIS Pro, update database connections to add this additional property:
   AUTHENTICATOR = username_password_mfa
3. For existing ArcGIS Pro projects, layers referencing data in Snowflake will need to be updated to use the latest connection file (where the MFA caching property is set). Please refer to this documentation for Updating data sources in ArcGIS Pro. 

Additional information: The Additional Properties parameter of the database connection dialog was added in the ArcGIS Pro 3.1 release. If you are using ArcGIS Pro 3.0 or earlier, consider upgrading to ArcGIS Pro 3.1 or a later release.

The Q2 2025 release of ArcGIS Pro (3.5) will support Snowflake’s key-pair authentication. This will provide organizations with another authentication type when connecting to Snowflake from ArcGIS Pro, in addition to basic authentication and browser-based SSO.

Snowflake will soon add support for Programmatic Access Tokens (PAT). This is in private-preview as of March 2025 and will be a drop-in replacement for passwords. Esri is currently evaluating whether connections to Snowflake using basic authentication in existing releases of ArcGIS Pro and ArcGIS Enterprise can be updated to use a PAT in place of a password. For more information on PAT, please refer to this Snowflake blog.

ArcGIS Enterprise

ArcGIS Enterprise 10.9.1 and later releases support connections to Snowflake using basic authentication (username and password). When multi-factor authentication (MFA) is enforced, these connections (data store items) in ArcGIS Enterprise which store credentials to Snowflake will stop functioning. This is because web services architectures, in general, do not support authentication types that require user interaction, such as MFA. 

The Q2 2025 releases of ArcGIS Pro and ArcGIS Enterprise (3.5/11.5) will support Snowflake’s key-pair authentication. Organizations who need to integrate data from Snowflake with ArcGIS Enterprise may consider upgrading to this release and using key-pair authentication with Snowflake. 

Organizations should consult with their IT and security teams to determine what action can be taken in Snowflake to prevent the disruption to ArcGIS Enterprise web layers. For more information on Snowflake’s MFA enforcement timeline, and approaches to delay the enforcement of MFA on a password-based account, please refer to this Snowflake Knowledge Base article: FAQ: Snowflake Will Block Single-Factor Password Authentication by November 2025.

Snowflake will soon add support for Programmatic Access Tokens (PAT). This is in private-preview as of March 2025 and will be a drop-in replacement for passwords. Esri is currently evaluating whether connections to Snowflake stored in ArcGIS Enterprise 10.9.1 or later releases using basic authentication can be updated to use a PAT instead of a password. For more information on PAT, please refer to this Snowflake blog.

ArcGIS Data Pipelines

When multi-factor authentication (MFA) is enforced on the user account, connections to Snowflake in ArcGIS Data Pipelines will stop functioning. 

In the ArcGIS Online update planned for Q2 2025, Esri will introduce support for Snowflake’s key-pair authentication, offering an alternative to basic authentication (username and password). 

For more information on Snowflake’s MFA enforcement timeline and steps to take before the availability of key-pair authentication in ArcGIS Data Pipelines (tentatively planned for Q2 2025), please refer to this Snowflake Knowledge Base article: FAQ: Snowflake Will Block Single-Factor Password Authentication by November 2025.

This article will be updated as soon as new information is available.