Organization Hub Insights¶

The Insights page in Organization Hub presents organization-level metrics through interactive tiles that display trends, alerts, and summary data from all accounts in your organization. Use Insights to monitor and analyze cost, security posture, query health, and storage.

Insights requires an organization account with premium views enabled.

Get started¶

1. Use Snowsight to sign in to the organization account.
2. Switch to the GLOBALORGADMIN role, or to a role that has been granted the appropriate ORGANIZATION_USAGE application roles. For more information, see Access control requirements.
3. In the navigation menu, select Organization Hub » Insights.

High-level highlights¶

The top of Insights contains highlights from each section. Select a tile to switch to the corresponding tile further down the page.

Billing and Cost¶

The Billing and Cost section of Insights contains the following tiles:

Security¶

The Security section of Insights contains the following tiles:

Query health¶

The Query health section of Insights contains the following tiles:

Access control requirements¶

Every Insights tile reads from a view in the ORGANIZATION_USAGE schema, so access to Insights is determined entirely by which ORGANIZATION_USAGE application roles a user’s role holds. There is no separate Insights privilege.

Users with the GLOBALORGADMIN role can read every ORGANIZATION_USAGE view, so they see all tiles. To give someone access without granting GLOBALORGADMIN, grant one or more of the granular application roles described in this section.

How access is evaluated¶

Snowflake evaluates access at two levels:

• Page access. Insights appears in the navigation menu, and the page opens, for a user whose role holds GLOBALORGADMIN or at least one of the granular application roles in the following table.
• Tile access. Each tile is authorized separately when it queries its underlying view. Tiles that the current role can read render normally. Tiles that it can’t read display a message stating that your role doesn’t hold the required application role, and the rest of the page continues to work.

Because the two levels are independent, a role with a single granular application role can open Insights and see a partially populated page. This is expected: grant additional application roles to fill in the remaining tiles.

Application roles used by Insights¶

Insights uses the following application roles:

Application roles required by each section¶

Some sections of Insights combine data from more than one domain and therefore require more than one application role:

The high-level highlights at the top of the page summarize the sections that follow, so each highlight follows the same rules as the tile it summarizes.

To confirm which application role a specific view requires, see Access schema in the organization account.

Example: Grant granular access to Insights¶

The following example creates a role for a security analyst who needs the Security section of Insights, but no cost or query data. Run these statements in the organization account:

USE ROLE GLOBALORGADMIN;

CREATE ROLE org_security_analyst;

-- Security tiles: users, logins, admin role membership, and Trust Center findings.
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_SECURITY_VIEWER TO ROLE org_security_analyst;

-- Account list, so the analyst can filter and group results by account.
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_ACCOUNTS_VIEWER TO ROLE org_security_analyst;

-- Organization Hub runs queries on a warehouse.
GRANT USAGE ON WAREHOUSE org_hub_wh TO ROLE org_security_analyst;

GRANT ROLE org_security_analyst TO USER jsmith;

When jsmith switches to org_security_analyst and opens Organization Hub » Insights, the Security section is populated, and the Billing and Cost and Query health tiles report that the role doesn’t hold the required application role.

To extend the same role to the rest of Insights, grant the remaining application roles:

USE ROLE GLOBALORGADMIN;

GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER TO ROLE org_security_analyst;
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_GOVERNANCE_VIEWER TO ROLE org_security_analyst;
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_USAGE_VIEWER TO ROLE org_security_analyst;

Alternatively, grant SNOWFLAKE.ORG_USAGE_ADMIN, which grants access to every view in the ORGANIZATION_USAGE schema, including views that Insights doesn’t use.

To review what a role can already read, use SHOW GRANTS:

SHOW GRANTS TO ROLE org_security_analyst;

Command Center is documented separately and requires GLOBALORGADMIN. See Organization Command Center.

Analyze organization insights with Cortex Code¶

You can investigate organization-wide cost, security, and usage in Cortex Code without signing in to each account separately.

In Cortex Code (CLI, Desktop, or the Snowsight panel), type /organization-management to invoke the skill, then describe what you want to know. For more information, see organization-management.

Example prompts:

Give me a 30-day executive summary of all accounts in my organization, including costs, usage, and reliability.

Review our organization-wide security posture: MFA adoption, login failures, and authentication settings.

Analyze cross-account credit and storage spending trends for a quarterly business review.