# Federated database user mapping by sub/groups claim > Depth-first rabbithole dossier for Federated database user mapping by sub/groups claim; source-anchored research pack. Parent: [Atlas Identity Federation and Resource Policy Boundaries](https://llms-explorer.com/tree/mongodb-atlas-identity-policy-frontier-20261001/) · 4 facets · 12 facts · page: https://llms-explorer.com/tree/federated-database-user-mapping-by-sub-groups-claim/ ## Definitions - [low] The `sub` claim is a unique pair-wise value based on the token recipient, tenant, and user, so two apps requesting ID tokens for the same user receive different `sub` claims but the same `oid` claims. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] The `oid` claim is a non-reusable GUID, and if a user exists in multiple tenants, they have a different object ID in each tenant, considered different accounts despite same credentials. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` ## How it works - [low] When creating role mappings in Atlas, the Azure group data sent in the SAML response must exactly match the configured Atlas role mapping name. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` ## Comparisons and alternatives - [low] Entra ID supports writing group names in the `memberOf` claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` ## Facts and statements - [low] MongoDB Atlas limits each database user to 100 assigned roles, each organization to $50 hourly billing, and each project to 25 federated database instances. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits each project to 100 database users and 500 Atlas users, while each organization is limited to 500 Atlas users and 500 API keys. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] Configure the Name to `memberOf`, clear Emit groups as role claims, set Request Binding to HTTP POST, and set Response Signature Algorithm to SHA-256. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] MongoDB Atlas limits each team to 250 users, each project to 100 teams, each organization to 250 teams, and each user to 100 teams and 250 organizations. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] Managing federated authentication requires Organization Owner access to organizations delegating federation settings to the instance. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] Configuring Microsoft Entra ID integration requires at least Cloud App Administrator and User Administrator privileges in the Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] The `name` claim provides a human-readable, non-unique, changeable value for display purposes only. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#core` - [low] Before testing, copy and save the Bypass SAML Mode URL for the IdP to bypass federated authentication if locked out of the Atlas organization, and keep the session logged in to the Federation Management Console to prevent lockouts. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/federated-database-user-mapping-by-sub-groups-claim-dfde054ffa/rabbithole-synthesis.md#troubleshooting` ## Related concepts - user — is a part of Federated database user mapping by sub/groups claim - claim — is a part of Federated database user mapping by sub/groups claim - Federated — is a part of Federated database user mapping by sub/groups claim - database — is a part of Federated database user mapping by sub/groups claim - mapping — is a part of Federated database user mapping by sub/groups claim - sub — is a part of Federated database user mapping by sub/groups claim - groups — is a part of Federated database user mapping by sub/groups claim