# User

> Snowflake users carry no direct charge, but a dormant account holding warehouse USAGE rights can still resume compute, and every credit spent needs an owner for attribution. ZopNight inventories users via SHOW USERS and flags accounts still on password-only authentication ahead of Snowflake's October 2026 MFA enforcement deadline.

Source: https://zop.dev/integrations/snowflake/user
Updated: 2026-08-19

---

A user is an identity that can authenticate and run queries under granted roles. Users carry no charge of their own. They still determine two things that shape the bill: who spend gets attributed to, and which forgotten identities can still wake compute up.

## Free objects, live privileges

A dormant user holding USAGE on a warehouse can still log in and resume it, and auto-resume handles the rest. Departed-employee accounts that keep their grants are simultaneously an access-hygiene problem and a latent cost trigger: a single scheduled task left running under a forgotten identity is enough to keep a warehouse cycling indefinitely, with nobody recognizable on the attribution line.

## Attribution starts with identity

Credits are burned by queries, and queries run as users. ZopNight inventories users from `SHOW USERS` (account-scoped, with no database parent) and enriches them with team, cost-center, and environment tags from `TAG_REFERENCES`, which is what lets warehouse spend roll up to owners instead of to an anonymous account total.

## The password deadline

Rule RC-2122 flags users still on password-only authentication ahead of Snowflake's October 2026 MFA enforcement deadline. The remediation is a security task with a cost side benefit: working through the flagged list forces an identity inventory, and dormant accounts tend to get found and dropped in the same pass.

## One identity per robot

Discovery itself follows the pattern this page argues for: ZopNight connects as a dedicated `ZOPNIGHT_SVC` service user with scoped roles, so its own queries are attributable and its privileges are auditable. Shared human credentials driving automation are how attribution dies.

## Spot the dormant ones

```sql
SELECT name, last_success_login, disabled, has_password
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE deleted_on IS NULL
ORDER BY last_success_login NULLS FIRST;
```

Identities that have never logged in, or not in months, surface at the top. Review their role grants before dropping anything. Expect rows in this view to trail live changes by up to 3 hours.