# Atlas federated database users and groups > Depth-first rabbithole dossier for Atlas federated database users and groups; source-anchored research pack. Parent: [Atlas Identity Federation and Resource Policy Boundaries](https://llms-explorer.com/tree/mongodb-atlas-identity-policy-frontier-20261001/) · 4 facets · 40 facts · page: https://llms-explorer.com/tree/atlas-federated-database-users-and-groups/ ## Definitions - [low] The `sub` claim is a unique pair-wise value based on token recipient, tenant, and user, so two apps requesting ID tokens for the same user receive different `sub` claims but the same `oid` claims. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] The `oid` claim is a non-reusable GUID, and if a user exists in multiple tenants, they have a different object ID in each tenant, considered different accounts despite same credentials. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` ## How it works - [low] When creating role mappings in Atlas, match the Azure group data in the SAML response exactly to the configured Atlas role mapping name, set Name to `memberOf`, and clear Emit groups as role claims. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [medium] Disconnecting an Identity Provider causes users authenticating via that IdP to lose access to Workload Identity Federation in the associated Atlas projects. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#troubleshooting` - [low] If using Microsoft Entra ID with Device Authorization Flow, you must enable Allow public client flows in the Azure app registration. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] If Device Authorization Flow is configured, you must pass the `--oidcFlows=device-auth` flag when connecting with mongosh. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#tools` - [low] When rotating Workforce Identity Provider signing keys, MongoDB automatically fetches the JWKS when existing access tokens expire, but clients like mongosh or Compass must be restarted after revoking JWKS. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#troubleshooting` ## Comparisons and alternatives - [low] When using an HTTP URL with Postman, the tool may automatically retry the request with HTTPS but strip the header and body, resulting in a 401 status code instead of the expected 301. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#troubleshooting` - [low] If you select Group Id in Azure, it sends the security group's Object ID rather than the human-readable name, though Entra ID supports writing group names in the `memberOf` claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` ## Facts and statements - [low] By default, groups can access all clusters and federated database instances in the project, and temporary groups can be configured to exist for 6 hours, 1 day, or 1 week. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits database users to 100 and Atlas users to 500 per project, with a maximum of 500 Atlas users and 500 API keys per organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas charges $50 per hour for billing per organization and supports 25 federated database instances per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas allows 250 users per team, 100 teams per project, 250 teams per organization, and 100 teams per user. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits custom MongoDB roles to 100 per project and assigned roles to 100 per database user. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [medium] For Workload Identity Federation, specify the user or group identifier associated with the configured Workload Identity Provider, which maps to the Object Id for Azure Entra ID groups and the Unique Id for GCP Service Accounts. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] To control blast radius for federated users, assign built-in or tighter custom roles and enable Restrict Access to Specific Clusters to select the target cluster. Sources: https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] Atlas supports a maximum of two Workforce IdPs per organization: one OIDC IdP for database access and one SAML IdP for UI access. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] The `C(USER)` format is for individual human users authenticated via OIDC, and `C(IDP_GROUP)` is for IdP groups mapped to MongoDB roles. Sources: https://raw.githubusercontent.com/ansible-collections/community.mongodb/master/plugins/modules/mongodb_atlas_oidc_user.py — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] Managing federated authentication requires Organization Owner access to organizations delegating federation settings, and at least Cloud App Administrator and User Administrator privileges in the Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] The resource `mongodbatlas_federated_database_instance` removes the `storage_stores.#.cluster_id` attribute and adds an `azure` attribute for creating federated databases with Azure cloud provider configuration. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#tools` - [low] Before testing, save the Bypass SAML Mode URL to bypass federated authentication if locked out, and keep the session logged in to the Federation Management Console to prevent lockouts. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#troubleshooting` - [low] MongoDB Atlas uses HTTPS URLs for security, and using HTTP URLs returns a 301 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] If an organization service account is assigned to a project, the Project Owner can manage the service account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas supports 250 organizations per user, 250 linked organizations per cross-organization configuration, 25 clusters per project, and 250 projects per organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas allows 50 total network peering connections per project (with node limits based on CIDR) and 25 pending network peering connections per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] Workforce Identity Federation is supported by Atlas dedicated clusters (M10 and above) running MongoDB version 7.0.11 and above, and supports only JWT authentication, not opaque access tokens. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] For Azure app registration, update `requestedAccessTokenVersion` to `2`, set the Redirect URL to `http://localhost:27097/redirect`, and include `offline_access` if supporting refresh tokens. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] For SAML configuration, set Request Binding to HTTP POST and Response Signature Algorithm to SHA-256. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] Connecting an application with Workload Identity Federation requires a supporting driver at a minimum version, including Java v5.1+, C#/.NET v2.25+, Go v1.17+ and PyMongo v4.7+. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#tools` - [low] If you download the certificate before setting temporary Identifier and Reply URL values, the certificate is not unique and must be re-downloaded after updating these values, as the thumbprint and expiration date change. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#troubleshooting` - [low] Creating a service account or API keys for a MongoDB Atlas organization requires Organization Owner access, while granting API keys access to a project requires Project Owner access. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] MongoDB Atlas allows only 1 Free cluster per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] HCP Terraform uses static IP ranges for features like notifications and VCS connections, retrievable via the IP ranges API, though ranges for workspaces or Stacks in remote execution mode are not published. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] IP allowlists define permitted CIDR ranges for connecting to organizations, agent pools, or workspaces, and the IP ranges for different features returned by the API may overlap. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] After Atlas deletes a temporary user or group, any client or application using those credentials loses access to the cluster. Sources: https://www.mongodb.com/docs/atlas/workforce-oidc.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] For `oidc_auth_type USER`, `database_name` must be `$external`; for `IDP_GROUP` it must be `admin`, and the `username` for an IDP_GROUP uses the format `/`. Sources: https://raw.githubusercontent.com/ansible-collections/community.mongodb/master/plugins/modules/mongodb_atlas_oidc_user.py — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] You can bypass the Atlas log in page by navigating directly to your IdP Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] The `name` claim provides a human-readable, non-unique identifier for display purposes only, and the `nonce` must match the original authorize request parameter or the token should be rejected. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#core` - [low] The Terraform provider resource `mongodbatlas_database_user` supports Workload OIDC, and `mongodbatlas_federated_settings_identity_provider` adds OIDC Workload support and create/delete operations for Workforce OIDC IdPs. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#tools` - [low] The data source `mongodbatlas_federated_settings_identity_provider` adds `description` and `authorization_type` fields, while `mongodbatlas_federated_settings_identity_providers` adds filtering support for Protocol and IdP type. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/atlas-federated-database-users-and-groups-ae51dbe564/rabbithole-synthesis.md#tools` ## Related concepts - and — is a part of Atlas federated database users and groups - Atlas — is a part of Atlas federated database users and groups - federated — is a part of Atlas federated database users and groups - database — is a part of Atlas federated database users and groups - users — is a part of Atlas federated database users and groups - groups — is a part of Atlas federated database users and groups