Organization administrators¶

Using the GLOBALORGADMIN role¶

Multi-account organizations should use the GLOBALORGADMIN in the organization account to perform organization-level tasks. A user with the GLOBALORGADMIN role is also known as the global organization administrator.

To perform tasks as the global organization administrator, do the following:

1. Sign in to the organization account.

2. Do one of the following:

   • If you are performing tasks in a SQL worksheet, execute the following command:

     USE ROLE GLOBALORGADMIN;
     

     Copy

   • If you are performing other tasks in Snowsight, switch your active role to GLOBALORGADMIN.

Using the ORGADMIN role¶

To perform tasks with the ORGADMIN role, do the following:

1. Sign in to an ORGADMIN-enabled account.

2. Do one of the following:

   • If you are performing tasks in a SQL worksheet, execute the following command:

     USE ROLE ORGADMIN;
     

     Copy

   • If you are performing other tasks in Snowsight, switch your active role to ORGADMIN.

Enabling the ORGADMIN role in an account¶

The first account in an organization has the ORGADMIN role enabled. You can use this account to enable the role in other accounts. For example, to enable the ORGADMIN role for an account my_account1, the organization administrator can execute the following command from an account that already has the ORGADMIN role enabled:

USE ROLE ORGADMIN;

ALTER ACCOUNT my_account1 SET IS_ORG_ADMIN = TRUE;

Keep the following in mind when enabling the ORGADMIN role:

• The ALTER ACCOUNT syntax only accepts the account name format of the account identifier. You cannot use the account locator to specify the account.

• By default, the ORGADMIN role can be enabled in a maximum of eight accounts. If your organization requires more accounts with the ORGADMIN role, contact Snowflake Support.

• The ORGADMIN role cannot be enabled for a reader account.

Disable the ORGADMIN role¶

You can prevent regular, ORGADMIN-enabled accounts from being used to perform organization-level tasks. To accomplish this, execute the ALTER ACCOUNT command to remove the ORGADMIN role from the account. For example, if you want to stop using the account_123 account to perform organization-level tasks, do the following:

1. Sign in to the organization account.

2. Assume the GLOBALORGADMIN role:

   USE ROLE GLOBALORGADMIN;
   

   Copy

3. Execute the following command:

   ALTER ACCOUNT <account_name> SET IS_ORG_ADMIN = FALSE;
   

   Copy

The ALTER ACCOUNT syntax only accepts the account name format of the account identifier. You cannot use the account locator to specify the account.