Snowflake Connected System with Microsoft Entra ID OAuth 2.0 Client Credentials - Scope and App Registration Configuration

Hello Appian Community,

We are implementing a Snowflake integration using the OOTB Snowflake Connected System and are configuring authentication through Microsoft Entra ID (Azure AD) using OAuth 2.0 Client Credentials Grant.

Our current setup is:

• Created a Snowflake Resource Application in Microsoft Entra ID.
• Configured an Application ID URI:
  api://<resource-app-id>

• Created an exposed permission:
  session:role-appian

• Created a separate Client Application for Appian.
• Granted API permissions and Admin Consent to the Client Application.
• Configured Appian with:
  • Client ID
  • Client Secret
  • Token Endpoint:
    https://login.microsoftonline.com//oauth2/v2.0/token
• Resource Application exposes scope:
  session:role-appian

When validating the connected system, Appian returns:

Authorization unsuccessful.

The token request endpoint returned an invalid response.

Please check the configuration and token request endpoint status.

Questions:

1. For Appian's Snowflake Connected System with OAuth 2.0 Client Credentials, should the Scope value be:
   api://<application-id-uri>/session:role-appian

2. Does Appian expect delegated scopes or application permissions/app roles?

3. Is there a documented example of Microsoft Entra ID External OAuth with Snowflake and Appian's Snowflake Connected System?

Any working configuration examples would be greatly appreciated.