title: Workaround for 'Snowflake only supports a single security integration from a single Azure AD tenant'
body: <p>I am sharing a solution as I think this will be useful for others.</p>
  <p>After following the instructions at <a href="https://docs.snowflake.com/en/user-guide/oauth-azure.html" rel="nofollow noreferrer">https://docs.snowflake.com/en/user-guide/oauth-azure.html</a> to integrate our Azure AD with Oauth to Snowflake, we got a problem. Snowflake only supports one security integration per AAD tenant.</p>
  <p>Since we wanted to use both integration on the client level and on the user level;</p>
  <pre><code>create security integration (...) 
     external_oauth_token_user_mapping_claim = 'sub' 
  vs
     external_oauth_token_user_mapping_claim = 'upn' 
  </code></pre>
  <p>To get around this we created two custom policies in AAD:</p>
  <pre><code>    New-AzureADPolicy -Definition @('
  {
      &quot;ClaimsMappingPolicy&quot;:
      {
          &quot;Version&quot;:1,&quot;IncludeBasicClaimSet&quot;:&quot;true&quot;, 
          &quot;ClaimsSchema&quot;: [{&quot;Source&quot;:&quot;application&quot;,&quot;ID&quot;:&quot;objectid&quot;,&quot;JwtClaimType&quot;:&quot;sfuser&quot;}]
      }
  }') -DisplayName &quot;SnowflakeUserObjectClaims&quot; -Type &quot;ClaimsMappingPolicy&quot;
  </code></pre>
  <p>and</p>
  <pre><code> New-AzureADPolicy -Definition @('
  {
      &quot;ClaimsMappingPolicy&quot;:
      {
          &quot;Version&quot;:1,&quot;IncludeBasicClaimSet&quot;:&quot;true&quot;, 
          &quot;ClaimsSchema&quot;: [{&quot;Source&quot;:&quot;user&quot;,&quot;ID&quot;:&quot;userprincipalname&quot;,&quot;JwtClaimType&quot;:&quot;sfuser&quot;}]
      }
  }') -DisplayName &quot;SnowflakeUserUpnClaims&quot; -Type &quot;ClaimsMappingPolicy&quot;
  </code></pre>
  <p>These could then be associated with one application registration for the application and another for the user ('Add-AzureADServicePrincipalPolicy'). In other words, the claims from each of these would always include the 'sfuser' claim. This also requires a manual change in the application manifest:</p>
  <pre><code>&quot;acceptMappedClaims&quot;: true,
  </code></pre>
  <p>We could now create the security integration in Snowflake, with our new claim:</p>
  <pre><code>  create security integration (...) 
        external_oauth_token_user_mapping_claim = 'sfuser' 
  </code></pre>
  <p>And Snowflake was able to use the new claim to authenticate requests from both our app.registrations.</p>