Loading
Upcoming Mandatory Changes to Public Key Infrastructure (PKI)Read More
Salesforce Enforces New Security Requirements in Summer 2026Read More
About Salesforce Data 360
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Set Up a Salesforce-Managed Private Network Route for Snowflake on Azure

            You are here:

            1. Salesforce Help
            2. Docs
            3. Data 360

            Set Up a Salesforce-Managed Private Network Route for Snowflake on Azure

            Connect Data 360 to your Snowflake on Azure data source with a Salesforce-managed private network connection by using Private Connect Multicloud for Data 360. Salesforce provisions and maintains the cross-cloud connection between Data 360 and Snowflake on your behalf. No configuration is needed on AWS or Azure.

            Required Editions

            Available in: Editions that support Data 360. See Data 360 edition availability
            User Permissions Needed
            To create a Snowflake network route: Data Cloud Architect permission set and Manage External Connections or Customize App permission
            To administer a Snowflake environment: Snowflake admin

            Limitations

            • Each Snowflake URL can be used by only one Data 360 tenant.
            • Private Connect Multicloud isn't available in all Data 360 regions. See the Supported Regions table in Step 1. Your Snowflake account can run in any Azure region.

            See Also

            Step 1: Prepare Your Snowflake Environment

            Confirm prerequisites and gather the Snowflake configuration values that Data 360 requires to establish the private network connection.

            1. Confirm that you have all of the following:
              1. A Snowflake account running on Microsoft Azure with Business Critical Edition or higher.
              2. An ACCOUNTADMIN role on your Snowflake account.
              3. A Data 360 tenant running in a supported Data 360 region. Private Connect Multicloud for Snowflake on Azure is available in these Data 360 regions:
                Supported Data 360 Regions
                us-west-2 us-east-2 ap-south-1
                us-east-1 ca-central-1 ap-southeast-1
                sa-east-1 eu-west-2 ap-southeast-2
                eu-west-3 eu-central-1 ap-northeast-1
                eu-central-2 eu-north-1 ap-northeast-2
                eu-south-1    
            2. Determine whether to enable the internal stage in Snowflake.

              The internal stage is a Snowflake-managed storage access path that Snowflake uses for data staging. Enable it if your Snowflake Internal Stage is set up for private-only access—that is, public network access is disabled on your storage account. Keep it disabled for all other configurations.

              If you're enabling the internal stage, run this command in Snowflake as ACCOUNTADMIN:

              ALTER ACCOUNT SET ENABLE_INTERNAL_STAGES_PRIVATELINK = TRUE;
            3. Run this query in Snowflake as ACCOUNTADMIN to get your Snowflake Private Link configuration: 
              SELECT KEY, VALUE FROM TABLE(FLATTEN(INPUT => PARSE_JSON(SYSTEM$GET_PRIVATELINK_CONFIG())));

              From the output, record these values:

              Value from Snowflake Value for Data 360 Definition Example
              privatelink-pls-id Snowflake Account Azure Resource ID The Azure Private Link service name for your Snowflake account. sf-pvlinksvc-eastus.00000000-0000-0000-0000-000000000000.eastus.azure.privatelinkservice
              privatelink-account-url Snowflake Account URL The private Snowflake account URL. https://myorg-myaccount.privatelink.snowflakecomputing.com
              privatelink_internal_stage (appears only if internal stage is enabled) Snowflake Internal Stage Azure Resource ID The full Azure Resource ID for the Snowflake-managed storage account that hosts your internal stage. /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>
            4. If you enabled the internal stage, derive the Snowflake storage account URL.

              Use the <storage-account-name> value from the privatelink_internal_stage output to form the URL: <storage-account-name>.privatelink.blob.core.windows.net. Save this URL—you need it when you create the private network route in Data 360.

            Step 2: Create the Private Network Route in Data 360

            Create the Salesforce-managed private network route in Data 360. Provisioning takes approximately 10 minutes.

            Complete Step 1.

            1. From the App Launcher, select Data Cloud.
            2. From Setup, in the Quick Find box, enter Data Cloud Setup, and then select Data Cloud Setup.
            3. Expand Admin Tools, and then select Private Connect.
            4. Click New.
            5. On the Add Private Network Route page, select the Snowflake tile.
            6. In the Select a Network panel, select Azure, and then click Add Private Network Route.
            7. From the Choose Management menu, select Salesforce-Managed, and then click Next.
            8. On the Configure Snowflake Private Network Route page, enter these values:
              1. Route Name: Enter a name that identifies the route.
              2. Route API Name: Data 360 autopopulates this field based on the route name.
              3. Description: Optionally enter a description of the connection.
              4. Under Step 1: Account, enter these values:
                • Snowflake Account URL: Enter the privatelink-account-url value from Step 1.
                • Snowflake Account Azure Resource ID: Enter the privatelink-pls-id value from Step 1.
              5. Under Step 2: Internal Stage, configure the internal stage setting.

                Keep Internal Stage Enabled (the default) if public network access is disabled on your Snowflake storage account. Select Disabled for all other configurations and skip the remaining fields in this section.

                If you enabled the internal stage, enter these values:

                • Storage Account URL: Enter the storage account URL that you derived in Step 1, in the format <storage-account-name>.privatelink.blob.core.windows.net.
                • Snowflake Internal Stage Azure Resource ID: Enter the privatelink_internal_stage value from Step 1.
            9. Save your configuration settings.

              Salesforce starts provisioning two Azure private endpoints—one for the Snowflake account and one for the internal stage. Provisioning takes approximately 10 minutes. While provisioning is in progress, the private network route details page shows Waiting for the Azure Resource ID to be provisioned for each Azure Resource ID field.

            Step 3: Authorize Endpoints and Validate the Connection

            After provisioning completes, authorize the private endpoints in Snowflake, update your network policy, and validate the connection.

            Complete Step 2 and wait for provisioning to complete. Provisioning is complete when the private network route details page shows two Azure Resource ID values.

            1. Authorize the Snowflake account endpoint.
              1. On the private network route details page in Data 360, copy the Azure Resource ID for the Snowflake account endpoint.
              2. Contact Snowflake Support to request authorization of the private endpoint for your Snowflake account, and provide the Azure Resource ID that you copied.
            2. Authorize the internal stage endpoint.
              1. On the private network route details page in Data 360, copy the Azure Resource ID for the Snowflake internal stage endpoint.
              2. In Snowflake, run this command as ACCOUNTADMIN: 
                SELECT SYSTEM$AUTHORIZE_STAGE_PRIVATELINK_ACCESS('<stage-private-endpoint-resource-id>');
            3. Update the Snowflake network policy for the Snowflake user that Data 360 uses to connect.

              The connection succeeds only after the network policy allows the required Salesforce-managed private endpoints. If you enabled the internal stage, there are two endpoints to add. Otherwise, there is one.

              1. Create a network rule of type AZURELINKID.
              2. Add the Azure Resource ID for the Snowflake account private endpoint to the VALUE_LIST property of the network rule.
              3. Create a network policy that includes the network rule in its ALLOWED_NETWORK_RULE_LIST property.
            4. Validate the connection.
              1. Check that the Snowflake account endpoint is authorized. The Azure Resource ID you provided to Snowflake Support appears in the output. 
                SELECT SYSTEM$GET_PRIVATELINK_AUTHORIZED_ENDPOINTS();
              2. If you enabled the internal stage, check that the internal stage endpoint is authorized. 
                SELECT SYSTEM$GET_STAGE_PRIVATELINK_AUTHORIZED_ENDPOINTS();

            After both endpoints are authorized and the network policy is updated, set up a Snowflake Zero Copy Query Federation connection.

            Edit the Private Network Route

            After you create the Private Network Route (PNR), you can edit its name and description.

            1. From the App Launcher, find and select Data Cloud.
            2. From Setup, in the Quick Find box, enter Data Cloud Setup, and then select Data Cloud Setup.
            3. Expand Admin Tools, and then select Private Connect.
            4. Find the row for the PNR that you created, and open its details page.
            5. Click Edit.
            6. Change the available settings and save your changes.
              • PNR Name: Enter a different name.
              • Description: Enter a different description.
             
            Loading
            Salesforce Help | Article