Which role has the ability to create and manage users and roles?

The USERADMIN system role is specifically designed for the task of creating and managing users and roles within a Snowflake account. This aligns with Snowflake's security model, which promotes the separation of duties. While other higher-level roles (like SECURITYADMIN or ACCOUNTADMIN) can also perform these actions through role inheritance, USERADMIN is the dedicated role for this specific purpose, following the principle of least privilege. Its scope is intentionally limited to user and role administration to segregate these tasks from object creation (SYSADMIN) and grant management (SECURITYADMIN).

A. ORGADMIN: This role operates at the organization level, responsible for creating and managing accounts within the organization, not for managing users and roles within a specific account.
C. SYSADMIN: This role's primary responsibility is to create and manage account-level objects such as warehouses, databases, and schemas, but it does not have privileges to manage users or roles.
D. SECURITYADMIN: This role's main function is to manage security by granting privileges on objects to roles. Although it inherits the USERADMIN role, its primary purpose is grant management, making USERADMIN the more precise answer for user creation. ---

1. Snowflake Documentation: System-Defined Roles

Reference: In the section "Summary of System-Defined Roles

" the documentation explicitly states:

USERADMIN: "Role that is dedicated to user and role management only."

SECURITYADMIN: "Role that can manage any object grant globally... This role is granted the USERADMIN and SYSADMIN system roles."

SYSADMIN: "Role that has privileges to create and manage warehouses and databases in an account."

ORGADMIN: "Role that manages operations at the organization level."

This directly supports USERADMIN as the dedicated role for user and role management.