> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Manage Mapping Atlas Roles to IdP Groups You can map your IdP (Identity Provider) groups to Atlas roles. This streamlines authorization setup. You can grant one IdP (Identity Provider) group one or more roles to simplify their access to Atlas organizations, projects, and clusters. **Note:** You can't edit roles for specific users on the Access Manager page if you configure role mappings for IdP (Identity Provider) groups. ## Role Mapping Process 1. Atlas applies the role mappings when you log in. 2. Atlas compares the IdP (Identity Provider) groups named **memberOf** to role mappings defined for your organizations. These organizations must use the same IdP (Identity Provider) that the user did to authenticate. **Note:** If a user has role mappings from multiple IdP (Identity Provider) groups in an organization, Atlas applies all roles that result from the user's group memberships during login. This means the user gets all permissions from all their mapped roles. - Atlas applies the mapped roles to federated users if you defined role mappings. - Atlas applies the default role if: - You don't have defined role mappings - Role mappings would result in a user without any roles - Organization role mappings define federated users' Atlas access. If a federated user logs in but doesn't belong to an IdP (Identity Provider) group mapped to a desired organization, Atlas removes the mapped role from the user in that organization and its projects. The federated user may still have other IdP (Identity Provider) groups. **Example:** Consider a scenario where a user belongs to the **admin** IdP (Identity Provider) group. You have configured a role mapping of **admin** to the [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) in **Organization A**. If you remove that user from the **admin** IdP (Identity Provider) group, Atlas deletes that users' [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) role when the user next logs in. - Every organization must have at least one user that has the [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) role. If removing a role removes the last owner from an organization, the removal fails. ## Required Access To manage federated authentication, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access to one or more organizations that delegate federation settings to the instance. ## Prerequisites To complete this tutorial, you must have: - Created an IdP (Identity Provider) application. This application must have a SAML attribute named to **memberOf**. Map this attribute to the IdP (Identity Provider) source attributes for groups. This attribute links the IdP (Identity Provider) groups with your Atlas roles. - Linked an [IdP to Atlas.](https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md#std-label-atlas-manage-fed-auth) - Mapped an [Atlas organizations](https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md#std-label-atlas-manage-fed-org-map) to your IdP (Identity Provider). - Created at least one group in your IdP (Identity Provider). - Add at least one user in your IdP (Identity Provider) application to a group you created. ## Add Role Mappings in Your Organization and its Projects 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Choose an organization in which you want to map roles. Click Organizations. Atlas displays all organizations where you are an [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) in a table. - Organizations connected to federated authentication display in the Actions column. - Organizations unconnected to federated authentication display Connect in the Actions column. To map roles in an organization: Click Connect to enable federated authentication for that organization if needed. Click and select View. 3. Navigate to the Create Role Mapping For Your Users page. Click Manage Role Mappings. Atlas displays the Organization Role Mappings page. Click Create A Role Mapping. Atlas displays the Create Role Mapping For Your Users page. 4. Assign Atlas organization roles to the desired IdP group. At the Map Group and Assign Roles stage: | Section | Action | | --- | --- | | Enter Group Name | Type the name of the group as it is displayed in your IdP (Identity Provider) in this field. Atlas assigns this group to your Atlas role. Note that the name of the group can't exceed 200 characters. If the IdP (Identity Provider) group doesn't exist, you can't enter a new group name to create a new IdP (Identity Provider) group. If you use Microsoft Entra ID as your IdP (Identity Provider) and you selected Group Id as your source attribute, enter the group's Object ID in this field instead of the group's name. To learn more, see [Configure Microsoft Entra ID as an Identity Provider.](https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md#std-label-atlas-configure-azuread-idp) | | Assign Organization Roles | Click on each Atlas organization role that you want to assign to the IdP (Identity Provider) group. | - If you don't need to assign any Atlas project roles to this IdP (Identity Provider) group, click Finish. You can skip the rest of this procedure. - If you need to assign Atlas project roles to this IdP (Identity Provider) group, click Next. 5. Assign Atlas project roles to the desired IdP group. The Assign Project Roles stage displays a table. This table includes project names and the roles you can assign for those projects. For each project, click the project roles that you want to assign to the IdP (Identity Provider) group. - If you don't need to review the roles assigned to this IdP (Identity Provider) group, click Finish. You can skip the rest of this procedure. - If you need to review the roles assigned to this IdP (Identity Provider) group, click Next. 6. Verify which Atlas roles have been assigned to the desired IdP group. The Review and Confirm stage displays the organization and project roles assigned to the IdP (Identity Provider) group. - If you agree with the roles assigned to this IdP (Identity Provider) group, click Finish. - If you need to change the roles assigned to this IdP (Identity Provider) group, click Edit. Atlas returns to the Map Group and Assign Roles stage. ## Edit Role Mappings in Your Organization and its Projects 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Choose an organization in which you want to edit role mappings. Click Manage Organizations. Atlas displays all organizations where you are an [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) in a table. Click next to the desired IdP (Identity Provider) Group Name and select View. 3. Navigate to the Create Role Mapping For Your Users page. Click Create Role Mappings. Atlas displays the Organization Role Mappings page. Click Edit to the right of the IdP (Identity Provider) group you want to change. Atlas displays the Edit Your Role Mapping For This Organization page. 4. Assign Atlas organization roles to the desired IdP group. At the Map Group and Assign Roles stage: | Section | Action | | --- | --- | | Enter Group Name | Type the name of the group as it is displayed in your IdP (Identity Provider) in this field. Atlas assigns this group to your Atlas role. Note that the name of the group can't exceed 200 characters. If the IdP (Identity Provider) group doesn't exist, you can't enter a new group name to create a new IdP (Identity Provider) group. If you use Microsoft Entra ID as your IdP (Identity Provider) and you selected Group Id as your source attribute, enter the group's Object ID in this field instead of the group's name. To learn more, see [Configure Microsoft Entra ID as an Identity Provider.](https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md#std-label-atlas-configure-azuread-idp) | | Assign Organization Roles | Click on each Atlas organization role that you want to assign to the IdP (Identity Provider) group. | - If you don't need to assign any Atlas project roles to this IdP (Identity Provider) group, click Finish. You can skip the rest of this procedure. - If you need to assign Atlas project roles to this IdP (Identity Provider) group, click Next. 5. Assign Atlas project roles to the desired IdP group. The Assign Project Roles stage displays a table. This table includes project names and the roles you can assign for those projects. For each project, click the project roles that you want to assign to the IdP (Identity Provider) group. - If you don't need to review the roles assigned to this IdP (Identity Provider) group, click Finish. You can skip the rest of this procedure. - If you need to review the roles assigned to this IdP (Identity Provider) group, click Next. 6. Verify which Atlas roles have been assigned to the desired IdP group. The Review and Confirm stage displays the organization and project roles assigned to the IdP (Identity Provider) group. - If you agree with the roles assigned to this IdP (Identity Provider) group, click Finish. - If you need to change the roles assigned to this IdP (Identity Provider) group, click Edit. Atlas returns to the Map Group and Assign Roles stage. ## Remove One Role Mapping in Your Organization and its Projects 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Choose an organization in which you want to map roles. Click Manage Organizations. Atlas displays all organizations where you are an [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) in a table. - Organizations connected to federated authentication display in the Actions column. - Organizations unconnected to federated authentication display Connect in the Actions column. To map roles in an organization: Click Connect to enable federated authentication for that organization if needed. Click and select View. 3. Navigate to the Organization Role Mappings page. Click Create Role Mappings. Atlas displays the Organization Role Mappings page. Click Delete to the right of the IdP (Identity Provider) group you want to remove. Atlas displays the Delete role mappings for this group modal. Click Delete to remove all role mappings from this IdP (Identity Provider) group. If you don't want to remove all role mappings, click Cancel.