# Atlas Secretless KV Authentication > Source-anchored research for Atlas Secretless KV Authentication. Run status: COMPLETED. Parent: [MongoDB Atlas on Azure](https://llms-explorer.com/tree/mongodb-atlas-on-azure/) · 3 facets · 14 facts · page: https://llms-explorer.com/tree/atlas-secretless-kv-authentication/ ## Problems, failure modes and limitations - MongoDB documents migration without cluster downtime: failed validation retains static credentials, while successful validation removes them and makes roleId authoritative. Private-network deployments have an additional asynchronous-validation caveat. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - The MongoDB-maintained Atlas Azure Terraform module documents role_id authentication for encryption at rest and removal of its deprecated encryption_client_secret variable in the v1.0.0 upgrade path. (low confidence) (verified as of 2026-10-24) — [source](https://github.com/terraform-mongodbatlas-modules/terraform-mongodbatlas-atlas-azure) ## Comparisons and alternatives - Removing long-lived credentials addresses one identity risk but leaves authorization and monitoring duties. OWASP separately identifies excessive permissions and missing monitoring as non-human-identity risks; this is general security context rather than evidence of an Atlas incident. (high confidence) — [source](https://owasp.github.io/www-project-non-human-identities-top-10/2025/introduction/) ## Facts and statements - Atlas uses an Atlas-managed Azure service principal and short-lived Entra-issued OAuth tokens to access Key Vault encryption keys, avoiding customer-managed long-lived client secrets in Atlas. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - MongoDB announced general availability on February 12, 2026; its Atlas changelog places the secretless Key Vault addition in February 2026. (high confidence) (verified as of 2026-02-12) — [source](https://www.mongodb.com/products/updates/now-ga-azure-key-vault-akv-secretless-authentication/) - Setup creates or locates the Atlas application's service principal in the customer's tenant, registers its object ID through Cloud Provider Access, grants Key Vault access, and configures encryption at rest with the returned roleId. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Atlas supports Azure RBAC or Key Vault access policies. Its RBAC instructions assign Reader for vault metadata and Key Vault Crypto User, or an equivalent custom role, for key operations; Microsoft separates management access from cryptographic data-plane access. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - MongoDB documents an M10-or-larger cluster, Atlas Project Owner access, and Azure permissions to register the enterprise application and authorize its key access as prerequisites; Free and Flex clusters are excluded. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - For private networking, an accepted migration PATCH does not complete Key Vault validation. Data nodes validate asynchronously; incorrect permissions can eventually disrupt encryption-at-rest operations and shut down the cluster. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Unversioned Key Vault key URIs are supported and resolve to the latest enabled key version, reducing the need to update configuration after key rotation. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Switching an existing Key Vault from access policies to Azure RBAC invalidates access-policy permissions. Microsoft warns of outages unless equivalent roles exist; secretless adoption should preserve a working authorization model during migration. (low confidence) (verified as of 2026-08-25) — [source](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide) - This feature changes authentication for customer-managed encryption-at-rest keys; MongoDB says cluster and application encryption behavior remains unchanged. (low confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Short-lived authentication reduces exposure from durable credentials but still requires narrowly scoped authorization. OWASP recommends temporary credentials and least privilege; MongoDB also directs users to scope the service principal's key permissions narrowly. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Microsoft instructs users to allow several minutes for Key Vault role assignments to refresh. Treating an Azure permission change as proof of immediately completed grant or revocation is unsafe; actual access needs verification. (low confidence) — [source](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)