ドキュメント変更履歴 2026-08-24

--- ahttps://docs.snowflake.com/en/user-guide/organization-hub-insights+++ bhttps://docs.snowflake.com/en/user-guide/organization-hub-insights@@ -16,7 +16,9 @@  1. Use %sf-web-interface-link% to sign in to the organization account.-2. Switch to the GLOBALORGADMIN role, or to a role that has been granted the appropriate-   [ORGANIZATION_USAGE application roles](/sql-reference/organization-usage#label-org-usage-access-org-account).+2. Switch to the `GLOBALORGADMIN` role, or to a role that has been granted the appropriate `ORGANIZATION_USAGE` application roles.+   For more information, see [](#label-org-hub-access-control). 3. In the navigation menu, select **Organization Hub** %raa% **Insights**.++<a id="label-org-hub-highlights"></a>  ## High-level highlights@@ -244,9 +246,174 @@ ## Access control requirements -Users with the GLOBALORGADMIN role can access Insights. Designated users and roles that have been granted the appropriate-[ORGANIZATION_USAGE application roles](/sql-reference/organization-usage#label-org-usage-access-org-account) can also access-Insights. Those application roles include ORGANIZATION_BILLING_VIEWER for cost data, ORGANIZATION_SECURITY_VIEWER for security-data, and ORGANIZATION_GOVERNANCE_VIEWER and ORGANIZATION_USAGE_VIEWER for query and warehouse data. For the full list, see+Every Insights tile reads from a view in the `ORGANIZATION_USAGE` schema, so access to Insights is determined entirely by which+[ORGANIZATION_USAGE application roles](/sql-reference/organization-usage#label-org-usage-access-org-account) a user's role holds.+There is no separate Insights privilege.++Users with the `GLOBALORGADMIN` role can read every `ORGANIZATION_USAGE` view, so they see all tiles. To give someone access without+granting `GLOBALORGADMIN`, grant one or more of the granular application roles described in this section.++<a id="label-org-hub-access-evaluation"></a>++### How access is evaluated++Snowflake evaluates access at two levels:++- **Page access.** Insights appears in the navigation menu, and the page opens, for a user whose role holds `GLOBALORGADMIN` or at+  least one of the granular application roles in the following table.+- **Tile access.** Each tile is authorized separately when it queries its underlying view. Tiles that the current role can read+  render normally. Tiles that it can't read display a message stating that your role doesn't hold the required application role,+  and the rest of the page continues to work.++Because the two levels are independent, a role with a single granular application role can open Insights and see a partially+populated page. This is expected: grant additional application roles to fill in the remaining tiles.++<a id="label-org-hub-app-roles"></a>++### Application roles used by Insights++Insights uses the following application roles:++<div className="colwidths-given">++  <colgroup>+    <col style={{ width: "40.0%" }} />+    <col style={{ width: "60.0%" }} />+  </colgroup>+  <thead>+    <tr>+      <th>Application role</th>+      <th>Data it makes visible in Insights</th>+    </tr>+  </thead>+  <tbody>+    <tr>+      <td>`ORGANIZATION_ACCOUNTS_VIEWER`</td>+      <td>+        The list of accounts in the organization. Required for the account+        filter and for tiles that break results down by account.+      </td>+    </tr>+    <tr>+      <td>`ORGANIZATION_BILLING_VIEWER`</td>+      <td>Cost in currency and contract utilization.</td>+    </tr>+    <tr>+      <td>`ORGANIZATION_GOVERNANCE_VIEWER`</td>+      <td>+        Query-level data, which comes from the+        [QUERY_HISTORY](/sql-reference/organization-usage/query_history) view.+      </td>+    </tr>+    <tr>+      <td>`ORGANIZATION_SECURITY_VIEWER`</td>+      <td>+        Users, logins, administrator role membership, and Trust Center findings.+      </td>+    </tr>+    <tr>+      <td>`ORGANIZATION_USAGE_VIEWER`</td>+      <td>Credit consumption, storage, and warehouse load.</td>+    </tr>+  </tbody>++</div>++`ORGANIZATION_OBJECT_VIEWER` grants access to object inventory views such as+[DATABASES](/sql-reference/organization-usage/databases), which no Insights tile reads. Granting it alone does not make Insights+usable.++<a id="label-org-hub-section-roles"></a>++### Application roles required by each section++Some sections of Insights combine data from more than one domain and therefore require more than one application role:++<div className="colwidths-given">++  <colgroup>+    <col style={{ width: "30.0%" }} />+    <col style={{ width: "70.0%" }} />+  </colgroup>+  <thead>+    <tr>+      <th>Section</th>+      <th>Application roles</th>+    </tr>+  </thead>+  <tbody>+    <tr>+      <td>**Billing and Cost**</td>+      <td>+        `ORGANIZATION_BILLING_VIEWER` for the cost and contract utilization tiles,+        and `ORGANIZATION_USAGE_VIEWER` for the storage tile.+      </td>+    </tr>+    <tr>+      <td>**Security**</td>+      <td>`ORGANIZATION_SECURITY_VIEWER`.</td>+    </tr>+    <tr>+      <td>**Query health**</td>+      <td>+        `ORGANIZATION_GOVERNANCE_VIEWER` for the query tiles, and+        `ORGANIZATION_USAGE_VIEWER` for the warehouse load tile.+      </td>+    </tr>+  </tbody>++</div>++The [high-level highlights](#label-org-hub-highlights) at the top of the page summarize the sections that follow, so each highlight+follows the same rules as the tile it summarizes.++To confirm which application role a specific view requires, see [Access schema in the organization account](/sql-reference/organization-usage#label-org-usage-access-org-account).++<a id="label-org-hub-grant-example"></a>++### Example: Grant granular access to Insights++The following example creates a role for a security analyst who needs the **Security** section of Insights, but no cost or query+data. Run these statements in the organization account:++```sql+USE ROLE GLOBALORGADMIN;++CREATE ROLE org_security_analyst;++-- Security tiles: users, logins, admin role membership, and Trust Center findings.+GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_SECURITY_VIEWER TO ROLE org_security_analyst;++-- Account list, so the analyst can filter and group results by account.+GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_ACCOUNTS_VIEWER TO ROLE org_security_analyst;++-- Organization Hub runs queries on a warehouse.+GRANT USAGE ON WAREHOUSE org_hub_wh TO ROLE org_security_analyst;++GRANT ROLE org_security_analyst TO USER jsmith;+```++When `jsmith` switches to `org_security_analyst` and opens **Organization Hub** %raa% **Insights**, the **Security** section is+populated, and the **Billing and Cost** and **Query health** tiles report that the role doesn't hold the required application role.++To extend the same role to the rest of Insights, grant the remaining application roles:++```sql+USE ROLE GLOBALORGADMIN;++GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER TO ROLE org_security_analyst;+GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_GOVERNANCE_VIEWER TO ROLE org_security_analyst;+GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_USAGE_VIEWER TO ROLE org_security_analyst;+```++Alternatively, grant `SNOWFLAKE.ORG_USAGE_ADMIN`, which grants access to every view in the `ORGANIZATION_USAGE` schema, including views+that Insights doesn't use.++To review what a role can already read, use+[SHOW GRANTS](/sql-reference/sql/show-grants):++```sql+SHOW GRANTS TO ROLE org_security_analyst;+```  Command Center is documented separately and requires GLOBALORGADMIN. See 

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-organization-user+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-organization-user@@ -96,4 +96,5 @@  </dd>+<a id="label-org-user-type-property"></a> <dt>`TYPE = { PERSON | SERVICE }`</dt> <dd>@@ -102,4 +103,5 @@  <dl>+<a id="label-org-user-type-property-person"></a> <dt>`PERSON`</dt> <dd>@@ -127,5 +129,5 @@  You can't change the type after you create the organization user. The [](/sql-reference/sql/alter-organization-user) command doesn't-accept the TYPE property.+accept the `TYPE` property.  Default: `PERSON`@@ -160,5 +162,5 @@ ## Examples -Create an organization user and set the EMAIL property. Because the TYPE property isn't specified, the organization user is a+Create an organization user and set the EMAIL property. Because the `TYPE` property isn't specified, the organization user is a `PERSON` user: @@ -176,9 +178,4 @@  When an account administrator imports an organization user group that contains `etl_pipeline`, the user object created in the regular-account is also a `SERVICE` user. If a service user named `etl_pipeline` already exists in the account, the administrator can link it to-the organization user by calling-[](/sql-reference/functions/system_link_organization_user), because both users are `SERVICE` users:--```sql-SELECT SYSTEM$LINK_ORGANIZATION_USER('etl_pipeline', 'etl_pipeline');-```+account is also a `SERVICE` user. For an example of linking this kind of organization user to an existing service user, see+[](/sql-reference/functions/system_link_organization_user).