Set up Azure private network link to Snowflake

||Connect docs via MCP

Azure Private Link creates a secure, private connection between services running in Azure. This document describes the steps to set this up between Snowflake and Atlan.

Who can do this?

You need Snowflake Support, and probably your Snowflake administrator involved - you may not have access or the tools to run these tasks.

Prerequisites

• Snowflake must be set up with Business Critical Edition (or higher).
• Open a ticket with Snowflake Support to enable Azure Private Link for your Snowflake account.
• Snowflake support takes 1-2 days to review and enable Azure Private Link.
• If you are using IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist. Please raise a support request to do so.

(For all details, see the Snowflake documentation.)

Five phases at glance

Phase	What happens	Owner	Typical time
1. Gather	Export the private link configuration	Snowflake admin	10 minutes
2. Build	Atlan creates a Private Endpoint; sends you its Resource ID + token	Atlan support	1–2 business days
3. Approve	Authorize the pending endpoint - the critical handshake	Snowflake admin	15 min (but expires and is needed to do it promptly)
4. Allowlist	Update your Snowflake network policy (if you use one)	Snowflake admin	15 minutes
5. Connect & verify	Point Atlan at the endpoint; configure stage access; test	Atlan User	30 minutes

Phase 1 - Gather your private link details

Owner: Snowflake admin

Log in to snowCLI using the ACCOUNTADMIN account, and run the following commands:

use role accountadmin;
select system$get_privatelink_config();

This produces output like the following (formatted here for readability):

{
   "regionless-snowsight-privatelink-url": "abc123.privatelink.snowflakecomputing.com",
   "privatelink-account-name": "abc123.west-europe.privatelink",
   "snowsight-privatelink-url": "abc123.west-europe.privatelink.snowflakecomputing.com",
   "privatelink-account-url": "abc123.west-europe.privatelink.snowflakecomputing.com",
   "privatelink-connection-ocsp-urls": "[]",
   "privatelink-pls-id": "abc123.westeurope.azure.privatelinkservice",
   "regionless-privatelink-account-url": "abc123.privatelink.snowflakecomputing.com",
   "privatelink_ocsp-url": "ocsp.abc123.west-europe.privatelink.snowflakecomputing.com",
   "privatelink-connection-urls": "[]"
}

Share details with Atlan support team

Share the following values with the Atlan support team:

• regionless-snowsight-privatelink-url
• privatelink-account-name
• snowsight-privatelink-url
• privatelink-account-url
• privatelink-connection-ocsp-urls
• privatelink-pls-id
• regionless-privatelink-account-url
• privatelink_ocsp-url
• privatelink-connection-urls

Atlan support finishes the configuration on the Atlan side using these values. Support then provides the Snowflake private endpoint resource ID and Azure token for you to approve the request.

Phase 2 - Atlan builds private endpoint

Owner: Atlan support

Atlan creates a Private Endpoint in its network targeting your pls-id. Support replies (typically 1–2 business days) with three things:

• The endpoint Resource ID - for example /subscriptions/…/resourceGroups/…/privateEndpoints/pe-yourco-snowflake
• An Azure token - proof the endpoint belongs to Atlan; required by the approval command
• The endpoint DNS name for Phase 5

The token expires

Run Phase 3 promptly after receiving these values. If approval fails with a token/authorization error, the token has likely expired - reply on your ticket and ask for a regenerated one. Nothing is broken; it's just time-limited by design.

Phase 3 - Approve pending endpoint

Owner: Snowflake admin

Until approved, the endpoint exists but carries no traffic. Here's the full lifecycle:

1. Created - Atlan builds the endpoint (Phase 2)
2. Pending - waiting for your approval. Connections time out in this state.
3. Approved - traffic flows. Atlan sees the status flip too.
4. Usable - proceed to Phases 4–5

Approve by running:

use role accountadmin;
select system$authorize_privatelink(
  '<endpoint-resource-id-from-phase-2>',
  '<azure-token-from-phase-2>'
);

-- Check current state at any time:
select system$get_privatelink_authorized_endpoints();

How to check status from each side

Side	How to check	Healthy result
Snowflake	SYSTEM$GET_PRIVATELINK_AUTHORIZED_ENDPOINTS()	Atlan's endpoint Resource ID appears in the list
Atlan	Ask on your support ticket: "what state does the endpoint show?"	Support confirms Approved (not Pending)

Stuck in pending?

The three usual causes, in order: (1) the AUTHORIZE command was never run - check with the query shown earlier; (2) the token expired before it was run - request a fresh one; (3) the Resource ID was mistyped - copy-paste it exactly. If all three check out, escalate on the ticket and ask Atlan to re-verify from its side.

Phase 4 - Update your network policy

Owner: Snowflake admin

Identical logic to the AWS guide: if your Snowflake account enforces a network policy, allowlist Atlan's private CIDR ranges - not the public IPs. See the Atlan Network Details page.

create network rule atlan_privatelink_rule
  mode = ingress  type = ipv4
  value_list = ('10.140.8.0/21');  -- your tenant's private CIDR range (shared by Atlan support)

Phase 5 - Connect and verify

Owner: Atlan User

1. In the crawler setup, enter the endpoint DNS name from Phase 2 in Account Identifiers (Host).
2. Click Test connection.

Internal stage access (recommended, not optional)

Large query results are staged in your Snowflake account's Azure Blob storage (*.blob.core.windows.net) and downloaded via temporary links - outside the private link. To keep this path private too:

1. Your cloud/network team - In the Azure portal, open the storage account backing your Snowflake internal stage and copy its Resource ID (Overview → JSON view).
2. Share it on your Atlan support ticket; Atlan creates a second private endpoint to the storage account.
3. Your cloud/network team - Approve the new pending connection: storage account → Networking → Private endpoint connections → Approve.

Success checklist

• Test connection passes
• Preflight checks pass
• A crawl scoped to one small schema completes
• A full crawl or miner run completes (first real exercise of stage traffic)

Multiple Snowflake accounts

Each Snowflake account needs its own private endpoint - endpoints aren't shared between accounts, even in the same org. To connect several accounts (prod, non-prod, regional):

1. Run Phase 1 (SYSTEM$GET_PRIVATELINK_CONFIG()) in each account and paste all outputs into one support ticket, clearly labeled per account.
2. Atlan returns one endpoint DNS per account; each Atlan connection uses its own.
3. Phases 3–4 repeat per account (each has its own approval and its own network policy).