Update the clean room UI to Snowflake authentication¶

Important

If you installed the Snowflake Data Clean Rooms application after May 1, you don’t need to read this article.

The Problem

Before May 1, users signed into the clean rooms UI using their clean room credentials. On May 1, Snowflake authentication became the default credentials used in new clean room UI installations, but not for older installations.

The Solution

Administrators who installed the clean room UI before May 1 need to migrate their clean rooms account to start using Snowflake authentication by the end of July 2025. This is done using a small, simple wizard that appears when you sign in to clean rooms with an account with administrator privileges.

The wizard walks you through three simple steps:

1. Download your current UI user list¶

Download the list of current UI users. If any users are not also Snowflake users, that is noted in the list. You will need to grant them access to the Snowflake account, or they will no longer be able to access the clean room UI in that account. (Before the change, you could access the clean room UI without having a Snowflake account if a clean rooms manager invited you.)

The report includes the following fields:

  • Email: The email address associated with the user account.

  • Users on Snowflake: The usernames associated with this email on Snowflake. If multiple users are associated with this email, all the users are shown here. Note that after switching the authentication, only the first user with this email to log in to the UI will see previous query results in the Analyses & Queries page. If there are multiple users and you need to change who sees the query results, contact Snowflake Support

  • Name: The first and last name of the user according to their Snowflake profile.

  • DCR role: The existing role in the DCR UI for this user, where Admin` maps to MANAGE_DCR_PROFILE_AND_FEATURES, MANAGE_DCR_CONNECTORS, and MANAGE_DCR_COLLABORATORS and Clean room manager maps to MANAGE_CLEANROOMS. See the full list of clean room roles.

You can see your email, username, first and last name in your Snowflake profile in Snowsight.

Note

If you have users whose clean room UI email does not exactly match their Snowflake account email, or if multiple users used the same email address, they can encounter problems.

2. Test your access¶

To test whether you can open the clean rooms UI with your Snowflake credentials, select Test Login and provide Snowflake credentials for any account that should be able to access this clean room UI.

3. Migrate¶

Switch the clean room UI sign in to Snowflake authentication for your account. That’s it – you’re done! The clean room UI sign in process should now be the same for Snowsight and the clean room UI. No need to take any special steps if you are using SSO.

Remember that you must switch your clean room UI to use Snowflake authentication by the end of July.

Analysis and query history migration details¶

If you do not see your clean room report history after logging in to the clean room UI, here are the possible reasons:

  • Reports are migrated for a clean room account upon first login after migration. If you don’t see reports at first, wait a bit to see if the reports appear in your clean room account.

  • You have not verified ownership of the Snowflake email address now associated with your clean room account. If this is the case, verify your email address in Snowflake.

  • If multiple users referenced the same Snowflake email in the old clean room UI, only the first user to log in to the clean room UI after migration has access to the reports. If you need to switch the reports to another user, please contact Snowflake Support.

Here are more details about the migration process:

The clean room UI previously used email addresses as a user credential. After migration, the clean room UI uses Snowflake user IDs. The system tries to find an exact match between an old clean room email addresses and a Snowflake user ID email address when migrating clean room reports.

The first time each user logs in to the clean room UI after migration, their query report history is associated with the Snowflake email as long as the following criteria are met:

  • The user has the same email on Snowflake as used in the clean room UI

  • The user’s email is verified in Snowflake.

If user does not have a Snowflake email, or the Snowsight email is not verified, the reports will not be moved over.

Language: English