# Atlas Bicep Private Endpoint > Source-anchored research for Atlas Bicep Private Endpoint. Run status: COMPLETED. Parent: [MongoDB Atlas on Azure](https://llms-explorer.com/tree/mongodb-atlas-on-azure/) · 4 facets · 14 facts · page: https://llms-explorer.com/tree/atlas-bicep-private-endpoint/ ## How it works - The February 28, 2026 PowerShell walkthrough obtains Atlas service identifiers, creates the Azure endpoint with manual approval, reads the NIC private IP, and registers the interface with Atlas. It corroborates the staged process but does not supply a tested Bicep module. (medium confidence) — [source](https://jaliyaudagedara.blogspot.com/2026/02/connecting-azure-to-mongodb-atlas-via.html?m=1) ## Problems, failure modes and limitations - If Azure endpoint creation fails with LinkedAuthorizationFailed because the tenant cannot access the linked subscription, Atlas documents retrying the Azure CLI command with --manual-request true. The corresponding Bicep manual connection collection is the relevant configuration to inspect. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) - If endpoint creation fails with LinkedAuthorizationFailed because the tenant cannot approve the linked service connection, Atlas documents retrying with --manual-request true; the corresponding Bicep connection collection is manualPrivateLinkServiceConnections. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) ## Comparisons and alternatives - The Bicep resource is Microsoft.Network/privateEndpoints. Its properties include subnet.id and manualPrivateLinkServiceConnections, whose connection properties include privateLinkServiceId. Parameterize the target with the Atlas-provided service resource ID rather than substituting the Atlas project ID. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/templates/microsoft.network/privateendpoints) - Gate automation on readiness: Atlas can return INITIATING while its service provisions, and the connection becomes usable after Atlas finishes configuration and reports AVAILABLE. Use status polling instead of assuming an ARM deployment success completes the Atlas connection. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) ## Facts and statements - Treat deployment as a staged workflow: create the Atlas Private Link Service, create the Azure consumer endpoint, then register that endpoint with Atlas. Mapping the Azure stage to Bicep is an implementation inference from the documented resource schema and Atlas workflow. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) - For Atlas-owned service approval, use the manual connection path. Microsoft defines manualPrivateLinkServiceConnections for administrators without approval access to the remote resource; the Atlas CLI example and firsthand walkthrough both use --manual-request true. Translating that flag to the Bicep property is an explicit implementation inference. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/templates/microsoft.network/privateendpoints) - After Azure creates the endpoint, obtain its resource ID and NIC private IP, then call atlas privateEndpoints azure interfaces create with the Atlas endpointServiceId, --privateEndpointId and --privateEndpointIpAddress. Azure resource creation alone does not finish Atlas registration. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) - After registration, retrieve the Atlas private endpoint-specific connection string for the application. The firsthand walkthrough retrieves connectionStrings.privateEndpoint, and the independent Terraform proof of concept demonstrates a -pl-0 endpoint-aware URI. (medium confidence) — [source](https://jaliyaudagedara.blogspot.com/2026/02/connecting-azure-to-mongodb-atlas-via.html?m=1) - Atlas documentation limits this private endpoint feature to M10 or higher; Microsoft’s Atlas landing-zone repository likewise identifies a minimum M10 dedicated cluster. A deployment targeting Free or Flex should not assume this feature is available. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md) - Brief Connect demonstrates Bicep parameter files alongside separate Atlas provisioning scripts, but its standard infrastructure guide explicitly excludes hardened VNet/private-endpoint environments and directs those deployments to tailored support. It is evidence for mixed orchestration, not a complete Atlas private endpoint Bicep recipe. (medium confidence) (verified as of 2026-06-29) — [source](https://docs.brief-connect.com/Product-Release-Notes/Brief-Connect-v2.5.x-New-Dashboard-Infrastructure-Release-Notes/) - Keep the Atlas endpoint-service ID separate from the Azure Private Link service resource ID: the former identifies the Atlas interface-registration operation; the latter targets the Azure endpoint connection. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) - Gate application rollout on Atlas reporting the endpoint service and endpoint as Available. Azure resource provisioning success alone is insufficient evidence that Atlas connectivity is ready. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-cluster-private-endpoint.md) - The independent Atlas-Azure-Link repository demonstrates automation spanning both Atlas and Azure providers, including a private endpoint and a client connection. It is Terraform evidence for orchestration, not a Bicep implementation or a current provider-version recommendation. (low confidence) — [source](https://github.com/eugenebogaart/Atlas-Azure-Link)