# Group-to-role mapping > Depth-first rabbithole dossier for Group-to-role mapping; source-anchored research pack. Parent: [Atlas Federated Authentication](https://llms-explorer.com/tree/atlas-federated-authentication/) · 1 facets · 7 facts · page: https://llms-explorer.com/tree/group-to-role-mapping/ ## Facts and statements - [low] Atlas compares IdP groups named memberOf to defined role mappings, and if a user belongs to multiple mapped groups, Atlas applies all resulting roles during login. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [low] Configuring role mappings for IdP groups prevents editing roles for specific users on the Access Manager page, as group membership determines access. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [low] Role mappings in Atlas must exactly match the Azure group data sent in the SAML response to ensure correct authorization. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [low] Integrating Atlas with a federated IdP enables just-in-time provisioning by mapping IdP groups to Atlas roles, simplifying user management. Sources: https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [low] To manage role mappings in the Atlas UI, click Manage Role Mappings under SAML Advanced Settings, enter a unique group name, and assign desired organization roles via checkboxes. Sources: https://duo.com/docs/sso-mongodb-atlas-uia — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [medium] Atlas customers can set up SSO with Microsoft Entra ID as the IdP, mapping IdP groups to Atlas roles between organizations and projects, though mapping to teams is not supported. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881, https://feedback.mongodb.com/ideas/CUSTOMER-I-10061 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#core` - [low] Configuring LDAP groups via role mapping overwrites manually configured organization permissions, and users not in the group will have their explicitly set permissions overwritten by default permissions upon login. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10061 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/group-to-role-mapping-d5a0c63781/rabbithole-synthesis.md#troubleshooting` ## Related concepts - mapping — is a part of Group-to-role mapping