Connect Snowflake MCP to Copilot Studio with delegated OAuth
Diesen Beitrag auf Deutsch lesen
A practical setup for Snowflake-managed MCP in Copilot Studio, covering Cortex Agent, Entra delegated OAuth, custom connector redirects, roles and end-user testing.
TL;DR
Snowflake-managed MCP calls always pass through Cortex Agent, so trial accounts blocked from Cortex can discover tools but cannot invoke them. Copilot Studio must use Manual OAuth because Snowflake lacks Dynamic Client Registration. Add the generated custom connector redirect URI to Entra, configure DEFAULT_SECONDARY_ROLES, and test both maker and end-user connections.
Original by Hazim SharafelDin, Betty Le, on The Custom Engine. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Use Manual OAuth and verify the generated custom connector redirect URI in Entra, because Snowflake does not support Dynamic Client Registration and the URI exists only after connector creation.
- Admins/CoE: Confirm Cortex Agent is enabled, the correct Power Platform environment is used, and both maker and test-pane connections succeed before approving the integration.
- Security/Compliance: Match the Entra UPN to Snowflake LOGIN_NAME, restrict delegated scopes where possible, grant only required USAGE permissions, and verify runtime activity under the delegated user.
Frequently asked questions
Why does Snowflake MCP discovery work but tool execution fail in Copilot Studio?
Snowflake-managed MCP routes every invocation through Cortex Agent. If Cortex Agent is blocked, especially on standard trials, discovery can succeed while calls fail.
Where does the Copilot Studio Snowflake MCP redirect URI come from?
Copilot Studio generates the redirect URI when it creates the custom connector. Copy it from the connector Security tab and add it to the Entra client app.
Why are Copilot Studio maker and test-pane Snowflake connections separate?
The maker connection configures the agent, while the test pane runs as the end user. Both connections must succeed for end-to-end tool calls.