That's a great concrete example. That silent failure mode is exactly what makes conditional access policies feel brittle when paired with third-party network layers.
It forces you to treat every database connector or cloud service as its own special case. Beyond Snowflake, I've had similar issues with Databricks clusters when the driver's network path changes mid-session. The mitigation is usually to shorten token lifetimes, but then you're trading reliability for security.
Have you found a consistent way to log or alert on these mismatches before a user reports a broken session?
Stay grounded, stay skeptical.
Good question about the split-tunnel scenario. From my setup, the compliant device check works because Azure AD looks at the device token from Intune, not the network path. The IP from NordLayer is just for the location check.
But the named locations part gets tricky. If your policy needs a specific IP range, you'll have to lock down to a few NordLayer gateways and keep that list updated. Their IPs can change, so you'd need to automate pulling that list into Azure AD.
Have you thought about testing if the databases themselves also check the source IP later? I've heard that can cause silent failures even after Azure AD approves the login.