Group-to-role mapping
Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15
↓ Facts as markdownall context files
Depth-first rabbithole dossier for Group-to-role mapping; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Facts and statements
- [low] Atlas compares IdP groups named memberOf to defined role mappings, and if a user belongs to multiple mapped groups, Atlas applies all resulting roles during login. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md [source]
- [low] Configuring role mappings for IdP groups prevents editing roles for specific users on the Access Manager page, as group membership determines access. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md [source]
- [low] Role mappings in Atlas must exactly match the Azure group data sent in the SAML response to ensure correct authorization. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
- [low] Integrating Atlas with a federated IdP enables just-in-time provisioning by mapping IdP groups to Atlas roles, simplifying user management. Sources: https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md [source]
- [low] To manage role mappings in the Atlas UI, click Manage Role Mappings under SAML Advanced Settings, enter a unique group name, and assign desired organization roles via checkboxes. Sources: https://duo.com/docs/sso-mongodb-atlas-uia [source]
- [medium] Atlas customers can set up SSO with Microsoft Entra ID as the IdP, mapping IdP groups to Atlas roles between organizations and projects, though mapping to teams is not supported. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881, https://feedback.mongodb.com/ideas/CUSTOMER-I-10061 [source]
- [low] Configuring LDAP groups via role mapping overwrites manually configured organization permissions, and users not in the group will have their explicitly set permissions overwritten by default permissions upon login. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-10061 [source]
Related concepts
- mapping — is a part of Group-to-role mapping
Children
- No children recorded.