Atlas org mapping and domain mapping

Parent: Atlas Identity Federation and Resource Policy Boundaries · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Atlas org mapping and domain mapping; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] Atlas displays all organizations where the user is an Organization Owner. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] The sub claim is a pair-wise unique value based on the token recipient, tenant, and user, while the oid claim is a non-reusable GUID. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]

Structure and components

[low] If a single user exists in multiple tenants, they contain a different object ID in each tenant and are considered different accounts despite using the same credentials. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]

How it works

[low] MongoDB Atlas allows configuring multiple OIDC Workforce Identity Providers for an organization only when associated with different domains, and does not support multiple IdP configurations using the same domain. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10592 [source]
[medium] When a single domain is mapped to multiple identity providers, users logging in via the MongoDB Cloud console are automatically redirected to the IdP associated with the first SAML IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[medium] To use an alternative identity provider when a domain is mapped to multiple IdPs, users must log in through either an SP-initiated or IdP-initiated login URL. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] When creating role mappings in Atlas, the Azure group data sent in the SAML response must exactly match the configured Atlas role mapping name. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]

Problems, failure modes and limitations

[medium] The domain verification method can be chosen only once and cannot be modified; to select a different method, the domain mapping must be deleted and recreated. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] A domain mapping cannot be deleted if it is associated with an IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md [source]

Comparisons and alternatives

[low] When using an HTTP URL with Postman, the tool may automatically retry the request with HTTPS but strip the header and body, resulting in a 401 status code instead of 301. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] If Group Id is selected, Azure sends the security group's Object ID rather than the human-readable group name. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Entra ID supports writing group names in the memberOf claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]

Facts and statements

[low] MongoDB Atlas uses HTTPS URLs for security, and using HTTP URLs returns a 301 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] If an organization service account is assigned to a project, the Project Owner can manage the service account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] MongoDB Atlas limits database users to 100 per project, Atlas users to 500 per project and organization, API keys to 500 per organization, and users to 250 per team. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas limits teams to 100 per project, 250 per organization, and 100 per user, while organizations are limited to 250 per user. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas limits linked organizations to 250 per cross-organization configuration, clusters to 25 per project, and projects to 250 per organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas limits custom MongoDB roles to 100 per project and assigned roles to 100 per database user. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas limits hourly billing to $50 per organization and federated database instances to 25 per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas limits total network peering connections to 50 per project and pending network peering connections to 25 per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] Atlas supports a maximum of two Workforce IdPs per organization: one OIDC IdP for database access and one SAML IdP for UI access. Sources: https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md [source]
[low] Mapping organizations to an Identity Provider grants users who authenticate through the IdP membership in the selected organizations. Sources: https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md [source]
[medium] Domain verification requires the file at <https://host.domain>/mongodb-site-verification.html to be accessible. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Configuring Microsoft Entra ID integration requires at least Cloud App Administrator and User Administrator privileges in the Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] The certificate's thumbprint and expiration date change from their initial values after the temporary Identifier and Reply URL are updated for the first time. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] To configure Entra ID group claims, set Name to memberOf and clear the Emit groups as role claims option. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] The SAML configuration requires Request Binding set to HTTP POST and Response Signature Algorithm set to SHA-256. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] MongoDB Atlas SSO supports SP and IDP initiated SSO, as well as Just In Time user provisioning. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] Workload Identity Federation supports C#/.NET driver v2.25+ and PyMongo v4.7+. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md [source]
[medium] To avoid a potential security vulnerability, the provided record file must be deleted after domain verification completes. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] If the certificate is downloaded before setting the Identifier and Reply URL values, the certificate will not be unique and must be downloaded again after those values are set. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Before testing, copy and save the Bypass SAML Mode URL for the IdP to use in case of lockout, and keep the session logged in to the Federation Management Console during testing. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Creating a service account or API keys for an organization requires Organization Owner access, while granting API keys access to a project requires Project Owner access. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] MongoDB Atlas limits Free clusters to 1 per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] HCP Terraform uses static IP ranges for features like notifications and VCS connections, retrievable via the IP ranges API, though ranges for workspaces or Stacks in remote execution mode are not published. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges [source]
[low] IP allowlists define CIDR ranges permitted to connect to an organization, agent pools, or specific workspaces, and the IP ranges for each feature returned by the API may overlap. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges [source]
[low] Connecting a Workload Identity Provider to an organization enables Workload Identity Federation for all projects within that organization. Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md [source]
[low] An IdP not connected to an org does nothing for database access; connecting the Workload IdP (Data Access) under Federation → Organizations displays a green "successfully connected" banner, allowing all projects in that org to use it. Sources: https://blog.saintmalik.me/mongodb-passwordless-auth-aks/ [source]
[low] The same IdP can be applied to multiple organizations, but each organization can only be assigned a single IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md [source]
[low] The selected default role applies only to users who authenticate through the IdP if they do not already have an Atlas role mapped to the IdP group. Sources: https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md [source]
[low] Disconnecting an organization from the Federation Application stops Atlas from granting membership or a default organization role to users authenticating through the IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-org-mapping.md [source]
[low] If a default organization role is selected, new users logging in to Atlas using the Login URL are assigned that role. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Managing federated authentication requires Organization Owner access to one or more organizations delegating federation settings to the instance. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] The Atlas log in page can be bypassed by navigating directly to the IdP Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] The Okta SAML Identifier URL pattern is https://www.okta.com/saml2/service-provider/<Customer_Unique>, the Reply URL pattern is https://auth.mongodb.com/sso/saml2/<Customer_Unique>, and the Sign-on URL pattern is https://cloud.mongodb.com/sso/<Customer_Unique>. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] MongoDB Atlas supports just-in-time user provisioning, which is enabled by default. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] The name claim provides a human-readable, non-unique value for display purposes only and can be changed. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]
[low] The mongodbatlas_federated_settings_org_config Terraform resource supports adding data_access_identity_provider_ids and user_conflicts, as well as detaching and updating the identity_provider_id. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md [source]

Related concepts

Atlas — is a part of Atlas org mapping and domain mapping
and — is a part of Atlas org mapping and domain mapping
domain — is a part of Atlas org mapping and domain mapping
mapping — is a part of Atlas org mapping and domain mapping
org — is a part of Atlas org mapping and domain mapping

Children

No children recorded.

← the whole tree · 3D view· how to read this page