Control-M for Databases: Snowflake Authentication Change

14 July 2025

Control-M for Databases 9.0.21.xxx and 9.0.20.xxx

BMC is alerting you that Snowflake will block single-factor password authentication in November 2025, as described in Snowflake Will Block Single-Factor Password Authentication by November 2025. As a result, you will not be able to authenticate a Snowflake database type in Control-M for Databases and these jobs will fail.

To avoid this issue, you must reconfigure the Snowflake authentication method with a programmatic access token (PAT), as described in Reconfiguring Snowflake Authentication. BMC recommends that you reconfigure your Snowflake authentication configuration by October 2025.

This issue only affects Control-M for Databases. There is no impact on the Control-M for Snowflake plug-in and these jobs will continue to run as normal.

Reconfiguring Snowflake Authentication

This procedure describes how to reconfigure the authentication for a Snowflake database type in Control-M for Databases, via the Snowflake service and Control-M, which enables Control-M for Database jobs with a Snowflake database type to run.

Before You Begin

• Record the Agent IP address where the required Control-M for Databases plug-in with the Snowflake database type is installed.

Begin

1. In the Snowflake service, do the following:
   1. Run the following SQL command to create or change a network policy for the required Agent IP address:
      ALTER NETWORK POLICY <Policy_Name>
      SET ALLOWED_IP_LIST = ('<Agent_IP_Address>');
   2. Do one of the following to apply a network policy at the account level, which affects all users, or at the required user level:
      • Account Level: Run the following SQL command:
        ALTER ACCOUNT SET NETWORK_POLICY = <Policy_Name>;
      • User Level: Run the following SQL command:
        ALTER USER <Username> SET NETWORK_POLICY = <Policy_Name>;
        For more information, see Controlling Network Traffic with Network Policies.
   3. From Users and Roles in the Admin tab, create a Programmatic Access Token (PAT) and record the token.
      For more information, see, Using Programmatic Access Tokens for Authentication.
2. In Control-M, do the following:
   1. From the  icon, select Configuration.
      The Configuration domain opens.
   2. From the  drop-down list, select Centralized Connection Profiles.
   3. The Centralized Connection Profiles page appears.
   4. Select the required Snowflake type Control-M for Databases connection profile.
      The Edit Centralized Connection Profile dialog box appears.
   5. From the left pane, select the Database Connection Parameters tab.
      The Database Connection Parameters pane appears.
   6. In the Password parameter field, type or paste the PAT and then click Save.
      You can now authenticate the Snowflake database type via Control-M for Databases.