# Entra ID group overage in Atlas > Depth-first rabbithole dossier for Entra ID group overage in Atlas; source-anchored research pack. Parent: [Atlas Identity Federation and Resource Policy Boundaries](https://llms-explorer.com/tree/mongodb-atlas-identity-policy-frontier-20261001/) · 4 facets · 23 facts · page: https://llms-explorer.com/tree/entra-id-group-overage-in-atlas/ ## How it works - [low] When creating role mappings in Atlas, the Azure group data in the SAML response must exactly match the configured Atlas role mapping name, with Name set to memberOf, Emit groups as role claims cleared, Request Binding set to HTTP POST, and Response Signature Algorithm set to SHA-256. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Group filtering does not apply to Microsoft Entra roles, and the restriction to groups assigned to the application exists because group names are not unique, allowing display names to be emitted only for explicitly assigned groups to reduce security risks. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] When using the option to exclude nested groups, the user must be a direct member of the group assigned to the application, and if group data is emitted as roles, only groups appear in the role claim, excluding any assigned application roles. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [low] If a transform applied to the original groups claim results in a new custom claim, the original groups claim is omitted, but if the configured regex matches no values, the custom claim is absent and the original groups claim is included; restricted names for custom group claims are ignored at runtime. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [low] In additionalProperties, only one of sam_account_name, dns_domain_and_sam_account_name, or netbios_domain_and_sam_account_name is required, with the first present value used if multiple are provided, and this option works only when groupMembershipClaims is set to ApplicationGroup. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Downloading the certificate before setting temporary Identifier and Reply URL values results in a non-unique certificate that must be re-downloaded after those values are updated, as the thumbprint and expiration date change. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` ## Problems, failure modes and limitations - [high] MongoDB Atlas does not plan to implement the non-standard Entra ID specific feature for handling group overage, and if a user is in more groups than the limit, the groups claim is omitted from the token. (verified as of 2026-10-15) Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10388, https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [high] Users with 200+ Entra ID group memberships cannot access the MongoDB Atlas UI because Microsoft Entra ID omits group claims from the authentication token when the maximum limit (150 for SAML, 200 for JWT) is exceeded, preventing Atlas from correctly mapping roles and permissions. (verified as of 2026-10-15) Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10388, https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference, https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [low] Microsoft Entra ID supports group filtering only if a user belongs to 1,000 or fewer groups including direct and transitive memberships; exceeding this limit prevents filtering and sends an overage claim instead. (verified as of 2026-10-15) Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [low] Tokens issued via the implicit flow have a five-group limit for group claims, and a hasgroups:true claim is included only if the user is in more than five groups. (verified as of 2026-10-15) Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Failing to restrict group names to those assigned to the application is an antipattern because any user could create a group with a duplicate name and gain access on the application side. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#antipatterns` ## Comparisons and alternatives - [low] If Group Id is selected in Azure, the security group's Object ID is sent instead of the human-readable name, whereas Entra ID supports writing group names in the memberOf claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] When using an HTTP URL with Postman, the tool may automatically retry with HTTPS but strip the header and body, resulting in a 401 status code instead of 301, which obscures the failure reason. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` ## Facts and statements - [medium] If the groups claim is omitted due to overage, the token includes a hasgroups claim set to true, indicating the client should use the Microsoft Graph API to determine the user's groups, or a link to the full groups list if the token is too large but not limited by hasgroups. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference, https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Managing federated authentication in MongoDB Atlas requires Organization Owner access to delegating organizations and at least Cloud App Administrator and User Administrator privileges in the Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Microsoft Entra Connect version 1.2.70 or later is required to synchronize group objects from Active Directory with the necessary group name attributes, as earlier versions omit these attributes. (verified as of 2026-10-15) Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` - [low] MongoDB Atlas uses HTTPS URLs for security, and using HTTP URLs returns a 301 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] Creating a service account or API keys for a MongoDB Atlas organization requires Organization Owner access, while granting API keys access to a project requires Project Owner access. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] A Project Owner can manage an organization service account assigned to a project, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits include 100 database users per project, 500 Atlas users, 500 API keys per organization, 250 teams per organization, 100 teams per user, 250 organizations per user, 250 linked organizations, 25 clusters, 250 projects, 100 custom roles, 100 assigned roles per database user, $50 hourly billing, 25 federated instances, 50 total network peering connections, 25 pending peering connections, and 1 Free cluster per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [low] The nonce claim must match the parameter in the original authorize request to the IDP, otherwise the application should reject the token. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#core` - [high] MongoDB drivers supporting Workload Identity Federation include C#/.NET v2.25+ and PyMongo v4.7+. The community.mongodb Ansible module mongodb_atlas_oidc_user separately uses OAuth2 client_credentials (Service Account) to authenticate to the Atlas API. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md, https://raw.githubusercontent.com/ansible-collections/community.mongodb/master/plugins/modules/mongodb_atlas_oidc_user.py — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#tools` - [low] To prevent lockouts during testing, save the Bypass SAML Mode URL for the IdP and keep the session logged in to the Federation Management Console, noting that the Atlas log in page can be bypassed by navigating directly to the IdP Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/entra-id-group-overage-in-atlas-83cc2685e3/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Entra — is a part of Entra ID group overage in Atlas - Atlas — is a part of Entra ID group overage in Atlas - group — is a part of Entra ID group overage in Atlas - overage — is a part of Entra ID group overage in Atlas