> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Set up Workforce Identity Federation with OIDC In MongoDB 7.0 and later, Workforce Identity Federation lets you use an external Identity Provider (IdP), such as your corporate IdP (Identity Provider), to authenticate and authorize a given workforce, such as employees, partners, and contractors. With Workforce Identity Federation, you can: - Manage your workforce access to MongoDB deployments through your existing IdP (Identity Provider). - Enforce security policies such as password complexity, credential rotation, and MFA (multi-factor authentication) within your IdP (Identity Provider). - Grant access for a [group of users or a single user.](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-add-db-user) After you configure your external IdP (Identity Provider) and add it to your Workforce Identity Federation one time, you can enable Workforce Identity Provider for multiple Atlas organizations. After you enable Workforce Identity Federation in a given organization, you can use it in all projects in that organization for database access. Workforce Identity Federation is supported by Atlas dedicated clusters (M10 and above) running MongoDB version 7.0.11 and above. You need to use MongoDB Shell or Compass to access Atlas with Workforce Identity Federation. To learn more about implementing Workforce Identity Federation access, see [Connect a Client to MongoDB with Workforce Identity Federation.](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-workload-supported-connections) ## Required Access To manage Workforce Identity Federation configuration, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access to Atlas. ## Procedures To access Atlas clusters with Workforce Identity Federation, complete the following steps: 1. Configure a Workforce Identity Provider (one-time setup). [Configure your external identity provider.](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-idp-oidc) [Configure Workforce Identity Provider in Atlas and enable it for your Atlas organization(s).](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-oidc) 2. Grant external identities (user principals) or groups access to MongoDB clusters. 3. Authenticate to your Atlas clusters with MongoDB Shell or Compass. ### Configure An External Identity Provider Application To configure Workforce Identity Federation with OIDC (OpenID Connect), register your OIDC (OpenID Connect) application with an IdP (Identity Provider) that supports OIDC (OpenID Connect) standard, such as [Microsoft Entra ID](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-azure-idp-oidc), [Okta](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-okta-idp-oidc), or Ping Identity. For step-by-step instructions on configuring specific identity providers, see: - [Configure Workforce Identity Federation from Okta](https://www.mongodb.com/docs/atlas/security/oidc-okta-setup.md#std-label-oidc-okta-setup) - [Configure Workforce Identity Federation from PingOne](https://www.mongodb.com/docs/atlas/security/oidc-pingone-setup.md#std-label-oidc-pingone-setup) **Note:** Workforce Identity Federation supports only JWT for authentication. It doesn't support opaque access tokens. You can configure your OIDC (OpenID Connect) application for the following grant types: - Authorization Code Flow with PKCE (Proof Key of Code Exchange) - Device Authorization Flow MongoDB recommends that you use Authorization Code Flow with PKCE (Proof Key of Code Exchange) for increased security. Use Device Authorization Flow only if your users need to access the database from machines with no browser. **Note:** If your identity provider is Microsoft Entra ID and you use Device Authorization Flow, you must enable Allow public client flows in your Azure app registration. To learn how to enable this setting, see the [Azure documentation.](https://docs.microsoft.com/en-us/azure/healthcare-apis/register-application) The OIDC (OpenID Connect) application registration steps can vary based on your IdP (Identity Provider). Ensure that you complete the following items during your registration process: 1. Register a new application for Atlas. Select public client/native application as the client type. 2. Set the Redirect URL value to `http://localhost:27097/redirect`. 3. (Conditional) Add or enable a groups claim if you authenticate with groups. For groups, this step ensures that your access tokens contain the group membership information of the user authenticating. MongoDB uses the values sent in a groups claim for authorization. 4. (Optional) Allow refresh tokens if you want MongoDB clients to refresh the tokens for a better user experience. 5. (Optional) Configure the access token lifetime (`exp` claim) to align with your database connection session time. After you register your application, save the `issuer`, `clientId`, and `audience` values to use in the next stage of the [Atlas Workforce IdP configuration.](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-apply-oidc-idp) ### Microsoft Entra ID To register your OIDC (OpenID Connect) application with Microsoft Entra ID: 1. Register an application. 1. Navigate to App registrations. In your [Azure portal](https://portal.azure.com/) account, search and click Microsoft Entra ID. In the Manage section of the left navigation, click App registrations. 2. Click New registration. 3. Apply the following values. | Field | Value | | --- | --- | | Name | Atlas Database - Workforce | | Supported Account Types | Accounts in this organizational directory only (single tenant) | | Redirect URI | - Public client/native (mobile & desktop)- `http://localhost:27097/redirect` | 4. Click Register. To learn more about registering an application, see [Azure Documentation.](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application) 2. Add a group claim. 1. Navigate to Token Configuration. In the Manage section of the left navigation, click Token Configuration. 2. Click Add groups claim. 3. In the Edit groups claim modal, select Security groups. What groups you select depend on the type of groups you configured in your Azure environment. You may need to select a different type of group to send the appropriate group information. 4. In the Customize token properties by type section, only select Group ID. 5. Click Add. To learn more about adding a group claim, see [Azure Documentation.](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-group-claims) 3. Add a user identifier claim to the access token. 1. Click Add optional claim. 2. In the Add optional claim modal, select Access. 3. Select a claim that carries a user identifier that you can refer to in MongoDB access logs such as an email. You can use the UPN (UserPrincipalName) claim to identify users with their email address. 4. Click Add. 5. In the Microsoft Graph Permissions note, check the box, and click Add. To learn more, see [Azure Documentation.](https://docs.microsoft.com/en-us/azure/active-directory/develop/optional-claims) 4. Update the manifest. 1. In the Manage section of the left navigation, click Manifest. 2. Update the requestedAccessTokenVersion from `null` to `2`. The number `2` represents Version 2 of Microsoft's access tokens. Other applications can use this as a signed attestation of the Active Directory-managed user's identity. Version 2 ensures that the token is a JSON Web Token that MongoDB understands. 3. Click Save. To learn more about adding an optional claim, see [Azure Documentation.](https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest) 5. Remember metadata. 1. In the left navigation, click Overview. Copy the Application (client) ID value. 2. In the top navigation, click Endpoints. Copy the OpenID Connect metadata document value without the `/.well-known/openid-configuration` part. You can also get this value by copying the value for `issuer` in the OpenID Connect metadata document URL (Uniform Resource Locator). The following table shows what these Microsoft Entra ID UI values map to in our Atlas Configuration Properties: | Microsoft Entra ID UI | Atlas Configuration Property | | --- | --- | | Application (client) ID | Client IDAudience | | OpenID Connect metadata document (without /.well-known/openid-configuration) | Issuer URI | ### Configure Workforce Identity Federation Authentication **Note: Prerequisite** This procedure requires you to have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access and assumes you already have an OIDC (OpenID Connect) application created in your IdP (Identity Provider). To learn how to configure an IdP (Identity Provider), see [Configure An External Identity Provider Application.](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-idp-oidc) To configure a Workforce Identity Provider in Atlas: 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Configure identity providers. Click Identity Providers in the left sidebar. Do one of the following steps: - If you do not have any Identity Providers configured yet, click Set Up Identity Provider. - Otherwise, on the Identity Providers screen, click Configure Identity Provider(s). Select Workforce Identity Federation and click Continue. Select OIDC for Data Access. 3. Enter the following Workforce Identity Provider Protocol Settings. | Setting | Necessity | Value | | --- | --- | --- | | Configuration Name | Required | Human-readable label that identifies this configuration. This label is visible to your Atlas users. | | Configuration Description | Optional | Human-readable label that describes this configuration. | | Issuer URI | Required | Issuer value provided by your registered IdP (Identity Provider) application. Using this URI, MongoDB finds an OpenID Provider Configuration Document, which should be available in the `/.well-known/openid-configuration` endpoint. | | Client ID | Required | Unique identifier for your registered application. Enter the `clientId` value from the app you registered with external Identity Provider. | | Audience | Required | Entity that your external identity provider intends the token for. Enter the `audience` value from the app you registered with external Identity Provider. Generally, this value is the same as the Client ID. | | Requested Scopes | Optional | Tokens that give users permission to request data from the authorization endpoint. If you plan to support refresh tokens, this field must include the value `offline_access`. If your identity provider is Microsoft Entra ID, Atlas requires this setting. Add default scope, which is `/.default`. For each additional scope you want to add, click Add more scopes. | | Authorization Type | Required | Select Group Membership to grant authorization based on IdP (Identity Provider) user group membership, or select User ID to grant an individual user authorization. | | Customize Groups Claim | Required | Identifier of the claim that includes the principal's IdP (Identity Provider) user group membership information. Accept the default value unless your IdP (Identity Provider) uses a different claim, or you need a custom claim. This field is only required if you select Group Membership. *Default*: `groups` | | Customize User Claim | Required | Identifier of the claim that includes the user principal identity. Accept the default value unless your IdP (Identity Provider) uses a different claim. *Default*: `sub` If your identity provider is Microsoft Entra ID and you select User ID as the Authorization Type, you can use one of the following values: `upn`: Use when your Atlas database user is configured with the User Principal Name (UPN).; `oid`: Use when your Atlas database user is configured with the Object ID. | 4. Click Save and Finish. 5. (Optional) Associate a domain to your Workforce IdP (Identity Provider). **Note:** This step is required only if you need to connect multiple Workforce IdP (Identity Provider)s to the same organization with different domains. Atlas supports a maximum of two Workforce IdP (Identity Provider)s connected to an organization: one OIDC IdP (Identity Provider) (for database access) and one SAML IdP (Identity Provider) (for UI access). In your Workforce Identity Provider card, click Associate Domains. In the Associate Domains with Identity Provider modal, select one or more domains. Click Submit. 6. Enable your Workforce Identity Provider in an organization. Click Connect Organizations. For the organization you want to connect to Workforce Identity Provider, click Configure Access. Click Connect Identity Provider. **Note:** If you have another IdP (Identity Provider) configured, this button says Connect Identity Provider(s). 7. Select Workforce Identity Federation for Data Access. In the Connect Identity Provider(s) modal, select a Workforce Identity Provider where the Purpose is Workforce Identity Federation. 8. Click Connect. When you connect your Workforce Identity Provider to an organization, Atlas enables your Workforce Identity Provider for all the projects within that organization. ### Add a Database User using Workforce Authentication 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fdatabase) page displays after you complete the preceding steps. 2. Open the Add New Database User or Group dialog box. Click Add New Database User or Group. **Note:** Until you [apply your Workforce IdP to Atlas](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-apply-oidc-idp), this button says Add New Database User. 3. Select Federated Auth. In the Authentication Method section, select Federated Auth. **Note:** Until you [enable Workforce IdP for your organization](https://www.mongodb.com/docs/atlas/workforce-oidc.md#std-label-configure-oidc), you can't select this box. 4. Select Identity Provider and Identifier In the Select Identity Provider section, select a configured OIDC (OpenID Connect) Identity Provider. Specify either the user identifier or group identifier associated with your configured Workforce Identity Provider. **Note:** For Azure Entra ID users, this value maps to the Object Id of your Azure user group rather than user group name. 5. Assign user or group privileges. To assign privileges to the new user or group, do one or more of the following tasks: - Select a [built-in role](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-user-privileges) from the Built-in Role dropdown menu. - You can select one built-in role per database group in the Atlas UI. - If you delete the default option, you can click Add Built-in Role to select a new built-in role. - Select or add [custom roles.](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md#std-label-mongodb-roles) - If you have any custom roles defined, you can expand the Custom Roles section and select one or more roles from the Custom Roles dropdown menu. - Click Add Custom Role to add more custom roles. - Click the Custom Roles link to see the custom roles for your project. - Add [privileges.](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-specific-privileges) - Expand the Specific Privileges section and select one or more privileges from the Specific Privileges dropdown menu. - Click Add Specific Privilege to add more privileges. This assigns the group specific privileges on individual databases and collections. - Remove an applied role or privilege. - Click Delete next to the role or privilege to delete. **Note:** Atlas doesn't display the Delete icon next to your Built-in Role, Custom Role, or Specific Privilege selection if you selected only one option. You can delete the selected role or privilege once you apply another role or privilege. Atlas can apply a built-in role, multiple custom roles, and multiple specific privileges to a database group. To learn more about authorization, see [Role-Based Access Control](https://www.mongodb.com/docs/manual/core/authorization/) and [Built-in Roles](https://www.mongodb.com/docs/manual/reference/built-in-roles/) in the MongoDB manual. 6. Specify the resources in the project that the user or group can access. By default, groups can access all the clusters and federated database instances in the project. To restrict access to specific clusters and federated database instances: Toggle Restrict Access to Specific Clusters/Federated Database Instances to On. Select the clusters and federated database instances to grant the group access to from the Grant Access To list. 7. Save as a temporary user or group. Toggle Temporary User or Temporary Group to On and choose a time after which Atlas can delete the user or group from the Temporary User Duration or Temporary Group Duration dropdown. You can select one of the following time periods for the group to exist: - 6 hours - 1 day - 1 week In the Database Users tab, temporary users or groups display the time remaining until Atlas deletes the users or group. After Atlas deletes the user or group, any client or application that uses the temporary user's or group's credentials loses access to the cluster. 8. Add the new database user or group. Do one of the following steps: - If you added a user, click the Add User button. - If you added a group, click the Add Group button. ### Connect a Client to MongoDB with Workforce Identity Federation The following lists the ways you can connect a client to MongoDB with Workforce Identity Federation authentication: - [Compass](https://www.mongodb.com/docs/atlas/compass-connection.md#std-label-atlas-connect-via-compass) v1.38+ - [MongoDB Shell](https://www.mongodb.com/docs/atlas/mongo-shell-connection.md#std-label-connect-mongo-shell) v2.1.4+ **Note:** If you configured Device Authorization Flow, you must pass the `--oidcFlows=device-auth` flag when connecting with [`mongosh`](https://www.mongodb.com/docs/mongodb-shell.md#mongodb-binary-bin.mongosh). For example: ```sh mongosh "" \ --authenticationMechanism MONGODB-OIDC \ --oidcFlows=device-auth ``` ## Manage an Existing Workforce Identity Federation Configuration ### View Workforce Identity Provider Configuration 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Click Identity Providers in the left sidebar. You can view all configured identity providers and their details. ### Update Workforce Identity Provider Configuration 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Click Identity Providers in the left sidebar. 3. In the Workforce Identity Provider card, click the Manage dropdown, then Edit Configuration. 4. Make your changes and click Save. ### View and Manage Connected Organizations 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Click Organizations in the left sidebar. You can view all connected organizations and manage their configurations. ### Revoke JWKS **Note:** Use the following procedure only if you manage your own signing keys. Don't use this feature to rotate your signing keys. When you rotate your Workforce Identity Provider signing keys, MongoDB fetches the JWKS automatically when the existing access tokens expire. If your private key is compromised, you can immediately revoke your JSON Web Key Sets (JWKS) cached in MongoDB nodes: 1. Update your signing keys in your Workforce identity provider. 2. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 3. Click Identity Providers in the left sidebar. 4. Scroll to the Workforce Identity Provider card. 5. Click the Manage dropdown, then Revoke JWKS. 6. Click Revoke. After you click Revoke, MongoDB fetches the new keys through your JWKS endpoint. You must restart your clients (such as [`mongosh`](https://www.mongodb.com/docs/mongodb-shell.md#mongodb-binary-bin.mongosh) or [Compass](https://www.mongodb.com/docs/compass/current/)) after you revoke JWKS. ### Delete a Workforce Identity Provider Configuration To delete your Workforce Identity Provider configuration: 1. In Atlas, go to the Federation Management console for your organization. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar. In the sidebar, click Federation under the Identity & Access heading. Click Open Federation Management App. The [Federation](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Ffederation) page displays. 2. Disconnect each organization you connected to your Workforce Identity Provider. 1. Click Organizations in the left sidebar. 2. Click the organization that has Workforce Identity Federation enabled. 3. Click Disconnect under the Manage dropdown on the Workforce Identity Federation card. 4. In the Disconnect identity provider? modal, click Disconnect. When you disconnect an IdP (Identity Provider), users who authenticate using the IdP (Identity Provider) lose access to Workforce Identity Federation in the Atlas projects listed in the Project table. 3. Click Identity Providers in the left sidebar. 4. In the Workforce Identity Provider card, click the Manage dropdown, then Delete Identity Provider. 5. In the Delete Identity Provider? modal, click Delete. ## Manage Workforce Identity Federation with the Atlas CLI You can use the Atlas CLI to manage Workforce Identity Federation configuration for your organizations. ### Configure Workforce Identity Federation Authentication To create an OIDC identity provider using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider create oidc [displayName] [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider create oidc.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-create-oidc/) ### Enable Workforce Identity Provider in an Organization To connect an identity provider to an organization using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs connect [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs connect.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-connect/) ### View Workforce Identity Provider Configuration To list all identity providers: To list the identity providers from your federation settings using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider list [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-list/) To view details of a specific identity provider: To describe the specified identity provider from your federation settings using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-describe/) To view federation settings: To return the federation settings details for the specified organization using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-describe/) ### Update Workforce Identity Provider Configuration To update an OIDC identity provider using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider update oidc [identityProviderId] [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider update oidc.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-update-oidc/) ### View and Manage Connected Organizations To list connected organizations: To list connected org configs using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs list [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-list/) To view details of a connected organization: To describe a connected org config using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-describe/) To update a connected organization: To update one org config connected to one federation setting using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs update [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs update.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-update/) To delete a connected organization: To delete a connected org config organization using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-delete/) ### Revoke JWKS To revoke the JWK token from the specified identity provider from your federation settings using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider revokeJwk [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider revokeJwk.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-revokeJwk/) ### Delete a Workforce Identity Provider Configuration To disconnect an organization: To disconnect an identity provider from an organization using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings connectedOrgConfigs disconnect [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings connectedOrgConfigs disconnect.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-connectedOrgConfigs-disconnect/) To delete the identity provider: To remove the specified identity provider from your federation settings using the Atlas CLI, run the following command: ```sh atlas federatedAuthentication federationSettings identityProvider delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas federatedAuthentication federationSettings identityProvider delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-federatedAuthentication-federationSettings-identityProvider-delete/)