Snowflake Azure PrivateLink Implementation Runbook

Business Critical Edition | Azure (East US 2) | End-to-end: Azure + Snowflake + DNS + Validation

1. Purpose and Scope

This Snowflake Azure PrivateLink implementation runbook provides a complete, step-by-step procedure to enable PrivateLink on Microsoft Azure for a Snowflake Business Critical account. It covers all required Azure networking steps (Resource Group, VNet, Subnets, Private Endpoint, Private DNS Zone), Snowflake authorization commands, DNS validation tests, common pitfalls, and secure access methods via Bastion or VPN. For data loading over this private connection, see our guide to loading data from Azure Cloud to Snowflake.

1.1 Target account details

The account URL, locator and hostnames in this runbook are placeholders (myorg-myaccount and xy12345). Use the values that your own account returns.

Authoritative Snowflake PrivateLink configuration (output of SYSTEM$GET_PRIVATELINK_CONFIG()):

{
  "privatelink-account-name": "xy12345.east-us-2.privatelink",
  "privatelink-pls-id": "sf-pvlinksvc-azeastus2prodshard2.ffc74fdb-c717-4c57-a041-8a8c52243329.eastus2.azure.privatelinkservice",
  "snowpark-connect-privatelink-url": "*.snowpark.iadzpr.privatelink.snowflakecomputing.com",
  "openflow-privatelink-url": "myorg-myaccount.openflow.iadzpr.privatelink.snowflakecomputing.com",
  "app-service-privatelink-url": "*.iadzpr.privatelink.snowflake.app",
  "regionless-snowsight-privatelink-url": "app-myorg-myaccount.privatelink.snowflakecomputing.com",
  "external-telemetry-privatelink-url": "myorg-myaccount.telemetry.iadzpr.privatelink.snowflakecomputing.com",
  "snowsight-privatelink-url": "app.east-us-2.privatelink.snowflakecomputing.com",
  "regionless-privatelink-ocsp-url": "ocsp.myorg-myaccount.privatelink.snowflakecomputing.com",
  "privatelink-account-url": "xy12345.east-us-2.privatelink.snowflakecomputing.com",
  "spcs-registry-privatelink-url": "myorg-myaccount.registry.privatelink.snowflakecomputing.com",
  "regionless-privatelink-account-url": "myorg-myaccount.privatelink.snowflakecomputing.com",
  "spcs-auth-privatelink-url": "sfc-endpoint-login.iadzpr.privatelink.snowflakecomputing.com",
  "privatelink_ocsp-url": "ocsp.xy12345.east-us-2.privatelink.snowflakecomputing.com"
}
      

1.2 High-level architecture

PrivateLink traffic flow:

• Client workload (VMs, apps) runs inside an Azure Virtual Network (VNet).
• Azure Private Endpoint provides a private IP in the VNet that connects to Snowflake’s Azure Private Link Service (PLS).
• Azure Private DNS resolves Snowflake PrivateLink hostnames (SQL, Snowsight, OCSP, etc.) to the Private Endpoint IP.
• After validation, Snowflake can optionally be locked down to PrivateLink-only inbound access.

Client / VM / App
|
| (Private DNS)
v
.privatelink.snowflakecomputing.com
|
v
Azure Private Endpoint (NIC: 10.x.x.x)
|
v
Snowflake Service (Azure)

2. Prerequisites

2.1 Access and Roles

• Snowflake: ACCOUNTADMIN role required for SYSTEM$* PrivateLink functions (SYSTEM$GET_PRIVATELINK_CONFIG, SYSTEM$AUTHORIZE_PRIVATELINK, SYSTEM$ENFORCE_PRIVATELINK_ACCESS_ONLY, etc.).
• Azure: Permissions to create Resource Groups, VNets, Subnets, Private Endpoints, Private DNS Zones, and to link DNS zones to VNets.

3. Azure Implementation Steps (Create if needed)

3.1 Create Resource Group

• 1. Azure Portal -> Resource groups -> Create.
• 2. Select the subscription and region (use East US 2 for consistency).
• 3. Name suggestion: rg-snowflake-privatelink-prod.
• 4. Review + Create -> Create.

3.2 Create Virtual Network (VNet)

• 5. Azure Portal -> Virtual networks -> Create.
• 6. Basics: select the resource group and region (East US 2).
• 7. IP Addresses: define an address space (example: 10.0.0.0/16).

• 8. Create subnets as described below or proceed to create and add subnets after VNet creation.
• 9. Review + Create -> Create.

3.3 Create Required Subnets

3.3.1 Create Private Endpoint Subnet

Private endpoint network policies are disabled on a subnet by default, which is all a Private Endpoint needs. You can optionally enable network security group or route table support for private endpoints on the subnet.

• 10. Open the VNet -> Subnets -> Add subnet.
• 11. Name: snet-privatelink-snowflake (example).
• 12. Subnet range (example): 10.0.0.0/24.
• 13. Leave private endpoint network policies at the default (Disabled), or enable network security group or route table support if you need it.
• 14. Save.

3.4 Create Azure Private Endpoint

Before creating the Private Endpoint, run SYSTEM$GET_PRIVATELINK_CONFIG() in Snowflake (as ACCOUNTADMIN) and copy the privatelink-pls-id value. This PLS ID identifies Snowflake's Azure Private Link Service that your endpoint will connect to.

• 15. Azure Portal -> Private Link -> Private endpoints -> Create.

• 17. Basics: Resource group, name (example: pe-snowflake-xy12345), Region: East US 2.
• 18. Resource: choose 'Connect to an Azure resource by resource ID or alias'.

• 20. Paste privatelink-pls-id into 'Resource ID or alias'.
• 21. Networking: select VNet and the Private Endpoint subnet (snet-privatelink-snowflake).
• 22. Review + Create -> Create.

After creation, capture the Private Endpoint private IP from the associated network interface. In this implementation, the Private Endpoint IP is 10.0.0.4 (example).

3.5 Create Private DNS Zone

The DNS zone name must be privatelink.snowflakecomputing.com. Link it to your VNet with auto-registration turned off.

• 23. Azure Portal -> Private DNS zones -> Create.
• 24. Name: privatelink.snowflakecomputing.com
• 25. Place in the same resource group (recommended).

• 27. Open the DNS zone -> Virtual network links -> Add.
• 28. Link to your VNet (where clients run).
• 29. Auto-registration: Off.
• 30. Create.

3.6 Create DNS Records

All hostnames returned by SYSTEM$GET_PRIVATELINK_CONFIG() that end with snowflakecomputing.com must resolve to the Private Endpoint IP in your VNet. Create A records in the Private DNS zone privatelink.snowflakecomputing.com pointing to 10.0.0.4 (your Private Endpoint IP).

• Do not add 0.0.0.0 as an additional IP in any record set.
• Azure record set names are relative to the zone, so each name is the FQDN without the trailing .privatelink.snowflakecomputing.com. For example, xy12345.east-us-2.privatelink.snowflakecomputing.com is the record set xy12345.east-us-2 in the privatelink.snowflakecomputing.com zone.
• The table covers the core endpoints. If you use Snowpark Connect, also add the wildcard record for *.snowpark.iadzpr. Snowflake-hosted apps use *.iadzpr.privatelink.snowflake.app, which needs its own Private DNS zone because it ends in snowflake.app, not snowflakecomputing.com.
• Testing from a laptop or Azure Cloud Shell will not resolve this zone unless your device is connected to the VNet (VPN) or you test from a VM inside the VNet.

4. Snowflake Implementation Steps

4.1 Retrieve PrivateLink Configuration

This is the source of truth for all PrivateLink hostnames and the PLS ID required for the Azure Private Endpoint.

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();

4.2 Authorize Azure Private Endpoint

You need the Azure Private Endpoint resource ID and an Azure access token. The user who generates the token needs Read permission on the subscription. First, get the resource ID and token from Azure CLI:

# Get the Private Endpoint resource ID
az network private-endpoint show --name pe-snowflake-xy12345 --resource-group rg-snowflake-privatelink-prod --query id -o tsv

# Get an Azure access token
az account get-access-token --subscription <SUBSCRIPTION_ID>

Then authorize the endpoint in Snowflake (ACCOUNTADMIN):

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$AUTHORIZE_PRIVATELINK('<azure-private-endpoint-resource-id>', '<azure-token>');

4.3 Verify Authorization

Confirm the endpoint has been authorized successfully:

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$GET_PRIVATELINK_AUTHORIZED_ENDPOINTS();

4.4 Optional - Enforce PrivateLink-Only Access

Warning: Run this only after you have validated DNS and connectivity from within the VNet, and run it while connected over private connectivity. Enforcing privatelink-only access requires Business Critical Edition or higher and blocks your account's public URLs, which then return "HTTP - 404 account not found". It doesn't affect public access to internal stage buckets. Any SaaS service that can't use private connectivity loses access, and so does SCIM provisioning if your identity provider sends SCIM requests over the public internet. If you enforce this too early, you will be locked out from the web UI and any non-VNet clients.

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$ENFORCE_PRIVATELINK_ACCESS_ONLY();

Rollback if needed:

-- Rollback: re-enable public access
USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$DISABLE_PRIVATELINK_ACCESS_ONLY();

5. Validation and Testing

5.1 Validate DNS Resolution

Important: You must test DNS resolution from inside the VNet (e.g., a VM in the VNet linked to the Private DNS zone). Do not test from Azure Cloud Shell or from a laptop on the public internet. By default, Azure Cloud Shell runs in a Microsoft network separate from your resources, so it cannot resolve your Private DNS zones.

nslookup xy12345.east-us-2.privatelink.snowflakecomputing.com

Expected result: The hostname resolves to the Private Endpoint IP (e.g., 10.0.0.4). If it resolves to a public IP or fails to resolve, check your Private DNS zone configuration and VNet link.

Also verify the Snowsight and OCSP hostnames:

nslookup app.east-us-2.privatelink.snowflakecomputing.com
nslookup ocsp.xy12345.east-us-2.privatelink.snowflakecomputing.com

All hostnames should resolve to the same Private Endpoint private IP (e.g., 10.0.0.4).

5.2 Validate HTTPS and SQL Connectivity

From the VNet VM, test HTTPS connectivity to the SQL endpoint:

curl -v https://xy12345.east-us-2.privatelink.snowflakecomputing.com

A successful response (HTTP 200 or TLS handshake success) confirms that the Private Endpoint is routing traffic correctly to Snowflake.

Snowsight (from browser inside the VNet VM):

https://app.east-us-2.privatelink.snowflakecomputing.com

5.3 Client connection strings (when connected via VNet/VPN)

Use these hostnames from SYSTEM$GET_PRIVATELINK_CONFIG():

• SQL: xy12345.east-us-2.privatelink.snowflakecomputing.com
• Snowsight: app.east-us-2.privatelink.snowflakecomputing.com
• Regionless SQL (optional): myorg-myaccount.privatelink.snowflakecomputing.com

6. Rollback Steps

If something goes wrong or you need to revert changes, follow these rollback procedures.

6.1 Disable PrivateLink Enforcement

If you enforced PrivateLink-only access too early and are locked out, run this from a VNet-connected client or contact Snowflake Support:

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$DISABLE_PRIVATELINK_ACCESS_ONLY();

This re-enables public internet access to your Snowflake account.

6.2 Revoke Authorized Endpoints

If you need to revoke an authorized Azure Private Endpoint, pass the same two arguments as the authorize call, with a fresh token from az account get-access-token:

USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$REVOKE_PRIVATELINK('<azure-private-endpoint-resource-id>', '<azure-token>');

After revoking, the Private Endpoint will no longer be able to route traffic to your Snowflake account.

Conclusion

Implementing Azure Private Link with Snowflake keeps traffic between your Azure workloads and Snowflake's service endpoints on the Microsoft backbone network. Internal stages, which PUT, GET and many drivers use, live in Azure storage and need their own private endpoints, which Snowflake documents separately as Azure private endpoints for internal stages; the subscription must first be registered with the Azure Storage resource provider. This runbook covered the end-to-end process, from creating Azure networking resources (VNet, Subnets, Private Endpoint, Private DNS) to authorizing and validating the connection in Snowflake. With PrivateLink enabled, you can securely share data across cloud providers and implement governance, security, and cost optimization strategies for your Snowflake environment.

Frequently Asked Questions