ALTER ORGANIZATION USER¶

Modifies the properties of an existing organization user.

See also:: CREATE ORGANIZATION USER , DROP ORGANIZATION USER , SHOW ORGANIZATION USERS

Syntax¶

ALTER ORGANIZATION USER [ IF EXISTS ] <name> SET [ objectProperties ]

ALTER ORGANIZATION USER <name> UNSET [ objectProperties ]

Where:

objectProperties ::=
  EMAIL = '<string>'
  DISPLAY_NAME = '<string>'
  FIRST_NAME = '<string>'
  MIDDLE_NAME = '<string>'
  LAST_NAME = '<string>'
  TYPE = { PERSON | SERVICE }
  COMMENT = '<string>'

Parameters¶

name

Specifies the identifier for the organization user to alter.

If the identifier contains spaces or special characters, the entire string must be enclosed in double quotes. Identifiers enclosed in double quotes are also case-sensitive.

For more information, see Identifier requirements.

SET ...

Set object properties. For a description of the object properties, see CREATE ORGANIZATION USER.

UNSET ...

Unset object properties. For a description of the object properties, see CREATE ORGANIZATION USER.

Unsetting the TYPE property makes the organization user a PERSON user, which is the default type.

Access control requirements¶

A role used to execute this operation must have the following privileges at a minimum:

Privilege	Object	Notes
MANAGE ORGANIZATION USERS	Account	By default, only the GLOBALORGADMIN and USERADMIN system roles in the organization account have this privilege.

For instructions on creating a custom role with a specified set of privileges, see Creating custom roles.

For general information about roles and privilege grants for performing SQL actions on securable objects, see Overview of Access Control.

Usage notes¶

When you change the TYPE property of an organization user, Snowflake also changes the type of the corresponding user object in every regular account that imported the organization user. This change also applies to existing users that were linked to the organization user with SYSTEM$LINK_ORGANIZATION_USER. Administrators in a regular account can’t change the type of these users.
The type of a user determines which authentication methods it can use. For example, a SERVICE user can’t authenticate with a password, and you can’t set up workload identity federation for a PERSON user. Before you change the type of an organization user, make sure that the corresponding users in each regular account authenticate with a method that the new type supports. For more information, see Types of users.

Examples¶

Change the email address of the organization user alice:

ALTER ORGANIZATION USER alice
  SET EMAIL = 'asmith@example.com';

Change the organization user report_loader to a SERVICE user. The corresponding user object in each regular account that imported report_loader also becomes a SERVICE user:

ALTER ORGANIZATION USER report_loader
  SET TYPE = SERVICE;

Change report_loader back to a PERSON user, which is the default type:

ALTER ORGANIZATION USER report_loader
  UNSET TYPE;