Atlas LDAP Azure AD DS
Parent: MongoDB Atlas on Azure · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-dfaf850dab9b
↓ Facts as markdownall context files
Source-anchored research for Atlas LDAP Azure AD DS. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- For Entra Domain Services, the Atlas guide requires uppercase DN attribute names and one DC component per domain segment. LDAP group entries use the complete group DN even when username-to-DN mapping is enabled. (low confidence) [source]
- The Azure tutorial specifies uppercase DN attribute names and a DC component for each managed-domain label. (low confidence) [source]
How it works
- A February 2023 Azure Active Directory user report describes successful Compass/CLI login without visible databases. Together with the Atlas troubleshooting guide, this supports checking the authorization query and returned group DNs separately from authentication; the forum provides no confirmed root cause or fix. (medium confidence) [source]
Problems, failure modes and limitations
- LDAP authentication and authorization were deprecated starting in MongoDB 8.0. The Atlas guide promises operation throughout MongoDB 8 and says removal will occur in a future major release; deprecation is not evidence that LDAP has already stopped working. (medium confidence) (verified as of 2026-10-14) [source]
- Microsoft states that users and service accounts cannot perform LDAP simple binds when NTLM password-hash synchronization is disabled on the managed domain. (low confidence) [source]
- LDAP was deprecated beginning with MongoDB 8.0. The current manual continues the deprecation in 9.0 and names only a future release for removal, so deprecation does not establish that LDAP is already removed. (high confidence) (verified as of 2026-10-24) [source]
- Microsoft lists unsynchronized accounts, missing password hashes, and account lockout as common managed-domain sign-in failures; external-tenant accounts cannot synchronize credentials into the managed domain. (low confidence) [source]
Comparisons and alternatives
- The Entra Domain Services LDAP integration authenticates database users rather than Atlas console users. Atlas supports authentication alone with per-user database roles, or authentication plus authorization with roles assigned to LDAP groups. (high confidence) [source]
Facts and statements
- The Atlas Entra LDAP guide requires M10 or larger clusters and identifies LDAP integration as an Enterprise feature; Free and Flex deployments are excluded. (medium confidence) (verified as of 2026-10-14) [source]
- The documented Azure integration needs a certificate for the managed domain, a PFX containing its private key on Domain Services, trusted certificate material on the client, and DNS resolving the LDAPS name to the service endpoint. (high confidence) [source]
- MongoDB’s Entra guide calls for public inbound access to destination port 636, whereas Microsoft recommends restricting public LDAPS to known source IP addresses with network security groups. These instructions need reconciliation for the specific Atlas deployment. (high confidence) [source]
- Atlas clients using this LDAP integration must set authSource=$external and authenticationMechanism=PLAIN. The Atlas Operator API documentation independently specifies $external as the authentication database for LDAP database users. (medium confidence) [source]
- Enabling LDAP authorization changes access behavior: users configured only for LDAP authentication lose database access until the group-based authorization configuration grants it. The guide offers {USER}?memberOf?base as a group lookup template. (low confidence) [source]
- Percona’s August 7, 2025 statement commits to retaining LDAP in Percona Server for MongoDB 9 and beyond. That statement concerns a different product and does not establish continuing LDAP support in Atlas. (low confidence) (verified as of 2025-08-07) [source]
- The Atlas Go client changelog records a January 2023 fix allowing PATCH of LDAP configuration after users could not set authenticationEnabled=false through LDAPConfigurations.Save(). This is historical tooling evidence, not a demonstrated current Azure-specific defect. (low confidence) [source]
- Entra ID does not directly support LDAP or LDAPS; Atlas integrates with the separate Entra Domain Services managed domain for database-user authentication. (high confidence) [source]
- The managed-domain LDAPS certificate must match the domain with a wildcard name; upload a private-key-bearing PFX to Domain Services and configure certificate trust for Atlas. (high confidence) [source]
- Atlas needs DNS resolution and network access to the managed-domain LDAPS endpoint. The Azure tutorial configures an external DNS record; Microsoft identifies TCP 636 as the public LDAPS port. (high confidence) [source]
- Bind and database accounts need compatible NTLM/Kerberos password hashes. Existing cloud-only users may need a password change after Domain Services is enabled; hybrid tenants need password-hash synchronization. (high confidence) [source]
- Atlas clients using LDAP must authenticate with PLAIN and authSource=$external; the directory user DN, or a configured username-to-DN mapping, identifies the account. (high confidence) [source]
- General Atlas LDAP guidance describes peering with a public FQDN resolving to a private IP, or public access restricted to cluster-node and Atlas Gateway IPs; Microsoft recommends restricting public LDAPS to known source IPs. (high confidence) [source]
- Enabling LDAP authorization can block users configured only for LDAP authentication; administrators should validate group membership and role mappings before enabling it. (medium confidence) [source]
- General Atlas guidance says OIDC authentication fails while LDAP authorization is enabled. MongoDB recommends Workforce Identity Federation for human users migrating from LDAP, so migration must account for this configuration constraint. (medium confidence) (verified as of 2026-10-24) [source]
Children
- Entra Domain Services LDAPS certificate lifecycle (frontier)
- Atlas LDAP group query and distinguished-name mapping (frontier)
- Entra Domain Services LDAPS certificate trust (frontier)
- LDAP group-to-role authorization in Atlas (frontier)
- Entra Domain Services password-hash synchronization (frontier)
Frontier under this node: Atlas LDAP group query and distinguished-name mapping, Entra Domain Services LDAPS certificate lifecycle, Entra Domain Services LDAPS certificate trust, Entra Domain Services password-hash synchronization, LDAP group-to-role authorization in Atlas