When using the ALLOW_CLI£NT_MFA_CACHING parameter, how long is a cached Multi-Factor Authentication (MFA) token valid for?

The ALLOWCLIENTMFACACHING is a user or account-level parameter that, when set to TRUE, enables supported clients to cache a user's successful Multi-Factor Authentication (MFA) token. According to official Snowflake documentation, this cached token remains valid for a default period of 4 hours. After this time expires, the user must re-authenticate with MFA on their next connection. This functionality balances security with user convenience by reducing the number of authentication prompts during a session.

A. 1 hour: This is an incorrect duration. The documented default caching period is explicitly set to 4 hours to reduce authentication friction.
B. 2 hours: This is not the standard validity period. Snowflake has defined a longer default time of 4 hours for the cached token.
D. 8 hours: This duration is incorrect. The default caching period is shorter than a full workday to maintain a stronger security posture.

1. Snowflake Inc. (n.d.). Multi-factor Authentication (MFA). Snowflake Documentation. Retrieved from https://docs.snowflake.com/en/user-guide/security-mfa. In the "MFA Token Caching" section, it states: "When enabled, Snowflake caches the MFA token for a period of 4 hours."

2. Snowflake Inc. (n.d.). Parameters. Snowflake Documentation. Retrieved from https://docs.snowflake.com/en/sql-reference/parameters#allow-client-mfa-caching. The documentation for the ALLOWCLIENTMFACACHING parameter confirms its purpose is to cache the second-factor authentication for a period of time, with the specific duration detailed in the primary MFA guide.