Which function is the role SECURITYADMIN responsible for that is not granted to role USERADMIN?

The SECURITYADMIN role is granted the MANAGE GRANTS privilege by default. This powerful privilege allows the role to modify any grant in the account, including revoking grants made by other roles. The USERADMIN role, which is focused solely on creating and managing users and roles, does not have this global grant management capability. While SECURITYADMIN inherits the privileges of USERADMIN (like creating users/roles), its unique and distinguishing function is the ability to manage system-wide grants.

A. Reset a Snowflake user's password: The USERADMIN role can perform user management tasks, including resetting passwords for users it creates or has ownership over.
C. Create new users: This is a primary function of the USERADMIN role, which has the CREATE USER privilege.
D. Create new roles: This is a primary function of the USERADMIN role, which has the CREATE ROLE privilege. ---

1. Snowflake Documentation: System-Defined Roles

Section: SECURITYADMIN

Content: "Role that can manage any object grant globally... This role is granted the MANAGE GRANTS privilege to allow it to modify any grant

including revoking it."

Section: USERADMIN

Content: "Role that is dedicated to user and role management only. More specifically

this role can create and manage users and roles..."

2. Snowflake Documentation: Access control privileges

Section: Global Privileges

Content: Describes the MANAGE GRANTS privilege: "Enables a role to grant or revoke privileges that have been granted by the privilege grantor (i.e. the role that holds the OWNERSHIP privilege on the object) to other roles." The SECURITYADMIN role holds this privilege by default.