GLOBALORGADMIN & ORGADMIN Reference

How to Use It

1. Sign in to the organization account.
2. Switch to the GLOBALORGADMIN role:

USE ROLE GLOBALORGADMIN;
SELECT CURRENT_ROLE();

If CURRENT_ROLE() does not return GLOBALORGADMIN, the user does not have the role granted. Check grants:

SHOW GRANTS TO USER CURRENT_USER();

Who Should Have GLOBALORGADMIN

• Organization administrators responsible for multi-account governance
• Users who need to view organization-wide usage, cost, and security data
• Users who manage account lifecycle (create, alter, drop)
• Users who manage organization users and user groups

GLOBALORGADMIN: Full Capability Catalog

1. Cost Governance

As GLOBALORGADMIN you have visibility into all spending across the entire organization.

Key focus areas:

• Spend concentration — identify which accounts drive the most cost
• Runaway warehouses — find warehouses burning credits disproportionately
• Service sprawl — track AI, Snowpipe, serverless, and other service costs growing quickly

2. Security Posture

Full visibility into authentication patterns, admin sprawl, and trust center findings across every account.

Key focus areas:

• Password-only logins without MFA — accounts vulnerable to credential attacks
• Admin sprawl — too many ACCOUNTADMIN/SECURITYADMIN grants across accounts
• SSO adoption — track SAML vs password vs OAuth login ratios
• Trust Center violations — critical and high-severity findings needing remediation

3. Account Lifecycle

Complete control over the organization's account inventory.

Key focus areas:

• Account inventory — know what exists, who owns it, what region it's in
• Region sprawl — data residency, latency, and compliance implications of accounts spread across regions

4. Organization Users & Groups

Manage identity at the organization level — users and groups that span accounts.

Note: Organization users and user groups require Enterprise Edition or higher.

5. Compliance & Audit

Visibility into data access patterns, privilege changes, and policy enforcement across the organization.

Key focus areas:

• Trust Center findings — CIS benchmark violations, MFA readiness, strong auth compliance
• Access history — who accessed sensitive data and when
• Grant changes — detect privilege escalation or unexpected role assignments
• Login anomalies — failed login spikes, unusual client types, geographic anomalies

6. Capacity & Reliability

Monitor compute, storage, and operational health across the organization.

Key focus areas:

• Query failures — syntax errors indicate training gaps; timeouts indicate sizing issues
• Warehouse queuing — P99 queue time indicates undersizing
• Storage growth — unbounded growth leads to surprise bills

7. Object Inventory & Governance

Visibility into databases, tables, views, and governance objects across all accounts.

8. GLOBALORGADMIN Self-Administration

Managing the GLOBALORGADMIN role itself and ORGADMIN legacy role.

ORGADMIN (Legacy)

What It Is

The ORGADMIN role allows organization-level tasks from any ORGADMIN-enabled account, not just the organization account. It is being phased out for multi-account organizations.

How to Use It

1. Sign in to an ORGADMIN-enabled account.
2. Switch to the ORGADMIN role:

USE ROLE ORGADMIN;
SELECT CURRENT_ROLE();

Enabling ORGADMIN in an Account

The first account in an organization has ORGADMIN enabled by default. To enable it in other accounts:

USE ROLE ORGADMIN;
ALTER ACCOUNT <account_name> SET IS_ORG_ADMIN = TRUE;

Rules:

• The ALTER ACCOUNT syntax only accepts the account name format of the account identifier — you cannot use the account locator.
• By default, ORGADMIN can be enabled in a maximum of 8 accounts. Contact Snowflake Support if you need more.
• ORGADMIN cannot be enabled for reader accounts.

Disabling ORGADMIN in an Account

To prevent an account from performing organization-level tasks:

1. Sign in to a different ORGADMIN-enabled account.
2. Execute:

USE ROLE ORGADMIN;
ALTER ACCOUNT <account_name> SET IS_ORG_ADMIN = FALSE;

Rules:

• Must be run from a different ORGADMIN-enabled account — you cannot disable it from the account being modified.
• The ALTER ACCOUNT syntax only accepts the account name format — not the account locator.
• You cannot disable ORGADMIN if it is the last account that has the role enabled. Contact Snowflake Support in that case.

ORGADMIN vs GLOBALORGADMIN

Decision Guide

When user asks "which role should I use?" or "how do I perform org-level tasks?":

Troubleshooting

"I can't switch to GLOBALORGADMIN"

• Confirm the user is signed in to the organization account, not a regular member account. GLOBALORGADMIN only exists in the organization account.
• Check if the role is granted: SHOW GRANTS TO USER CURRENT_USER();
• The role must be explicitly granted by another GLOBALORGADMIN user.

"ORGANIZATION_USAGE views say schema does not exist"

• The user is not using GLOBALORGADMIN. Run USE ROLE GLOBALORGADMIN; first.
• Or the user is in a regular account, not the organization account.

"ALTER ACCOUNT fails with invalid identifier"

• The ALTER ACCOUNT command requires the account name format, not the account locator.
• Use: ALTER ACCOUNT my_account_name SET ...
• Do NOT use: ALTER ACCOUNT AB12345 SET ...

"I want to enable ORGADMIN in more than 8 accounts"

• The default limit is 8 ORGADMIN-enabled accounts. Contact Snowflake Support to increase.

Reference Links

• Organization administrators
• Organization account
• Managing accounts
• Organization users