## Set up Azure private network link to Snowflake

URL: https://docs.atlan.com/apps/connectors/data-warehouses/snowflake/how-tos/set-up-an-azure-private-network-link-to-snowflake

> Set up Azure Private Link between your Snowflake account and your Atlan tenant, covering the five-phase handshake between Snowflake, Atlan support, and your cloud team.

[Azure Private Link](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview) creates a secure, private connection between services running in Azure. This document describes the steps to set this up between Snowflake and Atlan.

:::warning Who can do this?
 You need Snowflake Support, and probably your Snowflake administrator involved - you may not have access or the tools to run these tasks.

:::

## Prerequisites

- Snowflake must be set up with Business Critical Edition (or higher).
- Open a ticket with Snowflake Support to enable Azure Private Link for your Snowflake account.
- Snowflake support takes 1-2 days to review and enable Azure Private Link.
- If you are using IP allowlist in your Snowflake instance, you must add the [Atlan IP](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt) to the allowlist. Please [raise a support request](https://docs.atlan.com/support/submit-request) to do so.

(For all details, see the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/privatelink-azure).)

## Five phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Gather | Export the private link configuration | Snowflake admin | 10 minutes |
| 2. Build | Atlan creates a Private Endpoint; sends you its Resource ID + token | Atlan support | 1–2 business days |
| 3. Approve | Authorize the pending endpoint - **the critical handshake** | Snowflake admin | 15 min (but expires and is needed to do it promptly) |
| 4. Allowlist | Update your Snowflake network policy (if you use one) | Snowflake admin | 15 minutes |
| 5. Connect & verify | Point Atlan at the endpoint; configure stage access; test | Atlan User | 30 minutes |

## Phase 1 - Gather your private link details

**Owner:** Snowflake admin

Log in to snowCLI using the `ACCOUNTADMIN` account, and run the following commands:

```
use role accountadmin;
select system$get_privatelink_config();
```

This produces output like the following (formatted here for readability):

```
{
 "regionless-snowsight-privatelink-url": "abc123.privatelink.snowflakecomputing.com",
 "privatelink-account-name": "abc123.west-europe.privatelink",
 "snowsight-privatelink-url": "abc123.west-europe.privatelink.snowflakecomputing.com",
 "privatelink-account-url": "abc123.west-europe.privatelink.snowflakecomputing.com",
 "privatelink-connection-ocsp-urls": "[]",
 "privatelink-pls-id": "abc123.westeurope.azure.privatelinkservice",
 "regionless-privatelink-account-url": "abc123.privatelink.snowflakecomputing.com",
 "privatelink_ocsp-url": "ocsp.abc123.west-europe.privatelink.snowflakecomputing.com",
 "privatelink-connection-urls": "[]"
}
```

### Share details with Atlan support team

Share the following values with the [Atlan support team](https://docs.atlan.com/support/submit-request):

- `regionless-snowsight-privatelink-url`
- `privatelink-account-name`
- `snowsight-privatelink-url`
- `privatelink-account-url`
- `privatelink-connection-ocsp-urls`
- `privatelink-pls-id`
- `regionless-privatelink-account-url`
- `privatelink_ocsp-url`
- `privatelink-connection-urls`

Atlan support finishes the configuration on the Atlan side using these values. Support then provides the Snowflake private endpoint resource ID and Azure token for you to approve the request.

## Phase 2 - Atlan builds private endpoint

**Owner:** Atlan support

Atlan creates a Private Endpoint in its network targeting your `pls-id`. Support replies (typically 1–2 business days) with three things:

- The **endpoint Resource ID** - for example `/subscriptions/…/resourceGroups/…/privateEndpoints/pe-yourco-snowflake`
- An **Azure token** - proof the endpoint belongs to Atlan; required by the approval command
- The **endpoint DNS name** for Phase 5

:::caution The token expires

Run Phase 3 promptly after receiving these values. If approval fails with a token/authorization error, the token has likely expired - reply on your ticket and ask for a regenerated one. Nothing is broken; it's just time-limited by design.

:::

## Phase 3 - Approve pending endpoint

**Owner:** Snowflake admin

Until approved, the endpoint exists but carries no traffic. Here's the full lifecycle:

1. **Created** - Atlan builds the endpoint (Phase 2)
2. **Pending** - waiting for your approval. Connections time out in this state.
3. **Approved** - traffic flows. Atlan sees the status flip too.
4. **Usable** - proceed to Phases 4–5

Approve by running:

```sql
use role accountadmin;
select system$authorize_privatelink(
 '<endpoint-resource-id-from-phase-2>',
 '<azure-token-from-phase-2>'
);

-- Check current state at any time:
select system$get_privatelink_authorized_endpoints();
```

### How to check status from each side

| Side | How to check | Healthy result |
|---|---|---|
| Snowflake | `SYSTEM$GET_PRIVATELINK_AUTHORIZED_ENDPOINTS()` | Atlan's endpoint Resource ID appears in the list |
| Atlan | Ask on your support ticket: "what state does the endpoint show?" | Support confirms **Approved** (not Pending) |

:::info Stuck in pending?

The three usual causes, in order: (1) the AUTHORIZE command was never run - check with the query shown earlier; (2) the token expired before it was run - request a fresh one; (3) the Resource ID was mistyped - copy-paste it exactly. If all three check out, escalate on the ticket and ask Atlan to re-verify from its side.

:::

## Phase 4 - Update your network policy

**Owner:** Snowflake admin

Identical logic to the AWS guide: if your Snowflake account enforces a network policy, allowlist Atlan's **private CIDR ranges** - not the public IPs. See the [Atlan Network Details page](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt).

```sql
create network rule atlan_privatelink_rule
 mode = ingress type = ipv4
 value_list = ('10.140.8.0/21'); -- your tenant's private CIDR range (shared by Atlan support)
```

## Phase 5 - Connect and verify

**Owner:** Atlan User

1. In the crawler setup, enter the endpoint DNS name from Phase 2 in **Account Identifiers (Host)**.
2. Click **Test connection**.

### Internal stage access (recommended, not optional)

Large query results are staged in your Snowflake account's Azure Blob storage (`*.blob.core.windows.net`) and downloaded via temporary links - **outside the private link**. To keep this path private too:

1. *Your cloud/network team* - In the Azure portal, open the storage account backing your Snowflake internal stage and copy its **Resource ID** (Overview → JSON view).
2. Share it on your Atlan support ticket; Atlan creates a second private endpoint to the storage account.
3. *Your cloud/network team* - Approve the new pending connection: storage account → **Networking → Private endpoint connections → Approve**.

### Success checklist

- **Test connection** passes
- Preflight checks pass
- A crawl scoped to one small schema completes
- A full crawl or miner run completes (first real exercise of stage traffic)

## Multiple Snowflake accounts

Each Snowflake account needs its own private endpoint - endpoints aren't shared between accounts, even in the same org. To connect several accounts (prod, non-prod, regional):

1. Run Phase 1 (`SYSTEM$GET_PRIVATELINK_CONFIG()`) in each account and paste all outputs into one support ticket, clearly labeled per account.
2. Atlan returns one endpoint DNS per account; each Atlan connection uses its own.
3. Phases 3–4 repeat per account (each has its own approval and its own network policy).

---