Docs Menu

Docs HomeMongoDB Atlas

Configure Federated Authentication from Microsoft Entra ID

On this page

  • Limitations
  • Required Access
  • Prerequisites
  • Procedures
  • Add Domain users
  • Configure Microsoft Entra ID as an Identity Provider
  • Add Microsoft Entra ID as an Identity Provider in Atlas
  • (Optional) Map an Organization
  • (Optional) Configure Advanced Federated Authentication Options
  • Sign in to Atlas Using Your Login URL

This guide shows you how to configure federated authentication using Microsoft Entra ID as your IdP.

After integrating Microsoft Entra ID and Atlas, you can use your company's credentials to log in to Atlas and other MongoDB cloud services.

Atlas doesn't support single sign-on integration for database users. To configure Atlas to authenticate and authorize database users from Microsoft Entra ID using LDAP, see Configure User Authentication and Authorization with Microsoft Entra ID Domain Services.

To manage federated authentication, you must have Organization Owner access to one or more organizations that are delegating federation settings to the instance.

To use Microsoft Entra ID as an IdP for Atlas, you must have:

  • An Azure subscription. To obtain a subscription, visit the Microsoft Azure portal.

  • An Microsoft Entra ID tenant associated with your subscription. For information about setting up an Microsoft Entra ID tenant, see the Microsoft Entra ID Documentation.

  • Global Administrator privileges in your Microsoft Entra ID tenant.

  • A custom, routable domain name.

If you haven't already, use the Azure console to add your custom domain name to Microsoft Entra ID and create users:

1

Add your custom domain name to Microsoft Entra ID to create users that belong to your domain. After you add your domain, you must also add the Microsoft Entra ID DNS information in a TXT record with your DNS provider and verify the configuration.

To add your custom domain to Microsoft Entra ID, see the Azure documentation.

2

If they don't exist already, create users in Microsoft Entra ID that you want to grant access to. Users must belong to the custom domain you added to Microsoft Entra ID.

To create Microsoft Entra ID users, see the Azure documentation.

Use the Azure console to configure Microsoft Entra ID as a SAML IdP. You can either add the MongoDB Cloud app from the Gallery or configure an application manually.

Use the Federation Management Console and the Azure console to add Microsoft Entra ID as an IdP:

1
  1. Log in to Atlas.

  2. Use the dropdown at the top-left of Atlas to select the organization for which you want to manage federation settings.

  3. Click Settings in the left navigation pane.

  4. In Manage Federation Settings, click Visit Federation Management App.

2
  1. Click Configure Identity Providers.

  2. If you do not have any Identity Providers configured yet, click Setup Identity Provider. Otherwise, on the Identity Providers screen, click Add Identity Provider.

  3. Enter or select the following SAML Protocol Settings. All fields are required:

    Field
    Description
    Configuration Name
    Descriptive name, such as Microsoft Entra ID.
    IdP Issuer URI
    Microsoft Entra ID Identifier you copied from Azure earlier in the tutorial.
    IdP Single Sign-On URL
    Login URL that you copied from Azure earlier in the tutorial.
    IdP Signature Certificate

    Base64-encoded SAML signing certificate you downloaded from Azure earlier in the tutorial.

    You can either:

    • Upload the certificate from your computer, or

    • Paste the contents of the certificate into a text box.

    Request Binding
    HTTP POST.
    Response Signature Algorithm
    SHA-256.
  4. Click Next.

3
  1. Click Download metadata. You upload this file to Microsoft Entra ID in the next step.

  2. Click Finish.

4

To upload the file, see the screenshot in step 3 of Enable single sign-on for an app in the Azure documentation. Click Upload metadata file on the SSO configuration page, as shown in the screenshot in the linked Azure documentation.

Optionally, add a RelayState URL to your IdP to send users to a URL you choose and avoid unnecessary redirects after login. You can use:

Destination
RelayState URL
MongoDB Atlas
Login URL generated for your identity provider configuration in the Atlas Federation Management App.
MongoDB Support Portal
https://auth.mongodb.com/app/salesforce/exk1rw00vux0h1iFz297/sso/saml
MongoDB University
https://university.mongodb.com
MongoDB Community Forums
https://auth.mongodb.com/home/mongodbexternal_communityforums_3/0oa3bqf5mlIQvkbmF297/aln3bqgadajdHoymn297
MongoDB Feedback Engine
https://auth.mongodb.com/home/mongodbexternal_uservoice_1/0oa27cs0zouYPwgj0297/aln27cvudlhBT7grX297
MongoDB JIRA
https://auth.mongodb.com/app/mongodbexternal_mongodbjira_1/exk1s832qkFO3Rqox297/sso/saml

Mapping your domain to the IdP lets Atlas know that users from your domain should be directed to the Login URL for your identity provider configuration.

When users visit the Atlas login page, they enter their email address. If the email domain is associated with an IdP, they are sent to the Login URL for that IdP.

Important

You can map a single domain to multiple identity providers. If you do, users who log in using the MongoDB Cloud console are automatically redirected to the first matching IdP mapped to the domain.

To log in using an alternative identity provider, users must either:

  • Initiate the MongoDB Cloud login through the desired IdP, or

  • Log in using the Login URL associated with the desired IdP.

Use the Federation Management Console to map your domain to the IdP:

1

Open the FMC.

1

Log in to Atlas and use the drop-down in the upper-left corner to select the organization for which you want to manage federation settings.

2

Click Settings in the left navigation pane.

3

In Manage Federation Settings, click Visit Federation Management App.

2

Enter domain mapping information.

1

Click Add a Domain.

2

On the Domains screen, click Add Domain.

3

Enter the following information for your domain mapping:

Field
Description
Display Name
Label to easily identify the domain.
Domain Name
Domain name to map.
4

Click Next.

3

Choose your domain verification method.

Note

You can choose the verification method once. It cannot be modified. To select a different verification method, delete and recreate the domain mapping.

Select the appropriate tab based on whether you are verifying your domain by uploading an HTML file or creating a DNS TXT record:

4

Verify your domain.

The Domains screen displays both unverified and verified domains you've mapped to your IdP. To verify your domain, click the target domain's Verify button. Atlas shows whether the verification succeeded in a banner at the top of the screen.

After successfully verifying your domain, use the Federation Management Console to associate the domain with Microsoft Entra ID:

1

Click Identity Providers in the left navigation.

2

For the IdP you want to associate with your domain, click Edit next to Associated Domains.

3

Select the domain you want to associate with the IdP.

4

Click Confirm.

Important

Before you begin testing, copy and save the Bypass SAML Mode URL for your IdP. Use this URL to bypass federated authentication in the event that you are locked out of your Atlas organization.

While testing, keep your session logged in to the Federation Management Console to further ensure against lockouts.

To learn more about Bypass SAML Mode, see Bypass SAML Mode.

Use the Federation Management Console to test the integration between your domain and Microsoft Entra ID:

1

In a private browser window, navigate to the Atlas log in page.

2

Enter a username (usually an email address) with your verified domain.

Example

If your verified domain is mongodb.com, use an email address of the form username@mongodb.com.

3

Click Next. If you mapped your domain correctly, you'll be redirected to your IdP to authenticate. Upon successful authentication, you'll be redirected back to Atlas.

Note

You can bypass the Atlas log in page by navigating directly to your IdP Login URL.

Use the Federation Management Console to assign your domain's users access to specific Atlas organizations:

1
  1. Log in to Atlas.

  2. Use the dropdown at the top-left of Atlas to select the organization for which you want to manage federation settings.

  3. Click Settings in the left navigation pane.

  4. In Manage Federation Settings, click Visit Federation Management App.

2
  1. Click View Organizations.

    Atlas displays all organizations where you are an Organization Owner.

    Organizations which are not already connected to the Federation Application have Connect button in the Actions column.

  2. Click the desired organization's Connect button.

3

From the Organizations screen in the management console:

  1. Click the Name of the organization you want to map to an IdP.

  2. On the Identity Provider screen, click Apply Identity Provider.

    Atlas directs you to the Identity Providers screen which shows all IdPs you have linked to Atlas.

  3. For the IdP you want to apply to the organization, click Add Organizations.

  4. In the Apply Identity Provider to Organizations modal, select the organizations to which this IdP applies.

  5. Click Confirm.

4
  1. Click Organizations in the left navigation.

  2. In the list of Organizations, ensure that your desired organizations now have the expected Identity Provider.

You can configure the following advanced options for federated authentication for greater control over your federated users and authentication flow:

Note

The following advanced options for federated authentication require you to map an organization.

All users you assigned to the Azure application can log in to Atlas using their Microsoft Entra ID credentials on the Login URL. Users have access to the organizations you mapped to your IdP.

Important

You can map a single domain to multiple identity providers. If you do, users who log in using the MongoDB Cloud console are automatically redirected to the first matching IdP mapped to the domain.

To log in using an alternative identity provider, users must either:

  • Initiate the MongoDB Cloud login through the desired IdP, or

  • Log in using the Login URL associated with the desired IdP.

If you selected a default organization role, new users who log in to Atlas using the Login URL have the role you specified.

←  Manage Mapping Atlas Roles to IdP GroupsConfigure Federated Authentication from Google Workspace →