Snowflake Organizations and Account Management

1.What an organization is for, and what it contains

A business rarely stays at one Snowflake account. Production, development, a second region for disaster recovery, a partner-facing account: each is a separate account with its own users, roles, databases and warehouses. The organization is what ties them together. From it, organization administrators can view, create and manage all accounts across regions and cloud platforms.

The documentation lists the benefits: one view of every account, self-service account creation, data availability through replication and failover, data sharing with consumers across regions, and usage monitoring across all accounts. Organizations also make billing and other account administration simpler. The sources don't list costs as such. The trade-offs they do describe are that all accounts are billed together on one bill, and that the number of accounts is capped (covered below).

Identifying which regions are available for your organization is one of the organizational tasks you should be able to do. An organization administrator can view the list of regions available for the organization in Snowsight or with SQL. In Snowsight, open Admin » Accounts, select + Account and browse the Region list. In SQL, run SHOW REGIONS, which lists all the regions in which accounts can be created.

The output gives the Snowflake region name, the cloud provider that hosts it, the cloud provider's own name for the region, and a human-readable display name. If the organization spans multiple region groups, the output also includes a region_group column. Regions limit only where data is stored and compute is provisioned; they do not limit where users can connect from.

Sources1234

2.Creating, naming and deleting an organization

So the exam task "create and name an organization" is mostly about knowing who does it. If you sign up self-service, an organization is created automatically, with a system-generated name, when the account is created. If you set up accounts with Snowflake personnel, Snowflake creates the organization with a custom name. Either way, you can add more accounts to it afterwards.

To see the name, an organization administrator runs SHOW ACCOUNTS or opens Admin » Accounts in Snowsight, where the organization name appears above the account names. Any role can call CURRENT_ORGANIZATION_NAME to get the organization of the current account.

Renaming an organization, for example replacing a system-generated name with a friendlier one, goes through Snowflake Support. When you ask, you decide whether users can keep using the original account URL for a while. If you keep it, it is dropped automatically after 90 days. Deleting an organization also ends with Support: you delete every account except the one you are working from, then contact Support to delete that last account and the organization.

Putting these together, the organizational tasks you can perform yourself are:

- View the organization name and its accounts: SHOW ACCOUNTS, or Admin » Accounts in Snowsight (organization administrator). - Return the organization of the current account: the CURRENT_ORGANIZATION_NAME function (any role). - Find the organization's special account: SHOW ORGANIZATION ACCOUNTS lists the organization account of the organization. - Name the types of account in it: organization account, regular account (including trials) and Open Catalog account. - Remove an old organization URL early: after a rename you can delete it before the 90 days expire.

Tasks that change the organization itself, namely renaming it and deleting the last account and the organization, are done through Snowflake Support.

Sources15

3.Which regions an organization can use

An organization can span clouds and regions, but not every region is open to it automatically. An organization administrator sees the enabled regions in one of two ways: in Snowsight, by opening Admin » Accounts, selecting + Account and browsing the Region list, or in SQL with SHOW REGIONS.

That list sets a hard limit on account creation. You can only create an account in a region enabled for your organization. To use any other region, you ask Snowflake Support for access.

Sources32

4.Creating an account

The organization administrator manages each account's whole lifecycle, from creation to deletion. To create an account, select + Account under Admin » Accounts in Snowsight, or run CREATE ACCOUNT. You choose a cloud platform, a region and a Snowflake edition.

Three limits are worth knowing. An organization can have at most 25 On Demand accounts by default, or 100 if it has a capacity contract; Support can raise either limit. A new account becomes reachable only after DNS changes propagate, which takes about 30 seconds. And usage in every account appears on one bill.

The most important choice at creation time is the first user, who receives ACCOUNTADMIN. Mark it as a person and that user must enroll in MFA. Mark it as a service and it cannot authenticate with a password, so you must provide an RSA public key.

CREATE ACCOUNT my_admin
  ADMIN_USER_TYPE = SERVICE
  ADMIN_RSA_PUBLIC_KEY = 'MIIBIj...';

CREATE ACCOUNT my_admin ADMIN_USER_TYPE =  ? ;

Sources2

5.Listing, renaming and dropping accounts

To list accounts, use Admin » Accounts in Snowsight, where you can search and filter both active and dropped accounts, or run SHOW ACCOUNTS.

Renaming an account gives it a new account URL. By default the original URL is kept so users can go on using it; you can delete saved URLs later. To make everyone switch to the new URL immediately, clear Save Current URL in Snowsight or set SAVE_OLD_URL to FALSE in SQL. A rename has no effect on replication and failover. Reader accounts can be renamed only with SQL.

Dropping an account removes it from the organization. Dropping is the last step of the account lifecycle that the organization administrator manages.

ALTER ACCOUNT original_acctname RENAME TO new_acctname;

Sources678

6.Account-level parameters

Once an account exists, you control its behavior with parameters set through ALTER ACCOUNT. Most parameters are session parameters. A value set at the account level becomes the default for every user and session. Users can override it with ALTER USER, and sessions with ALTER SESSION. Object parameters work the same way: an account-level value becomes the default for objects created in the account.

One detail catches people out: SHOW PARAMETERS does not list account parameters by default. Some features are switched on only through an account parameter. For example, on Enterprise Edition, ACCOUNTADMIN can turn on periodic rekeying of encrypted data:

ALTER ACCOUNT SET PERIODIC_DATA_REKEYING = TRUE;

Sources9

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.An administrator creates the organization with a SQL command and can rename it the same way.Why is that wrong?

   Customers never create an organization directly. It is created automatically with the first account, or by Snowflake, and renaming or deleting it requires Snowflake Support.

   Covered in Creating, naming and deleting an organization

2. 2.Renaming an account breaks the old URL immediately, so users are locked out until they update their bookmarks.Why is that wrong?

   By default the original URL is saved and keeps working. Users are forced onto the new URL only if you set SAVE_OLD_URL to FALSE or clear Save Current URL.

   Covered in Listing, renaming and dropping accounts