IdP configuration (Entra ID)

Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for IdP configuration (Entra ID); source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

How it works

[low] Tokens requested via the implicit flow include a "hasgroups":true claim only if the user is in more than five groups. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] If a transform applied to the original groups claim results in a new custom claim, the original groups claim is omitted from the token. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]

Problems, failure modes and limitations

[low] Group claims have a five-group limit if the token is issued through the implicit flow. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] Exceeding the group limit causes Microsoft Entra ID to completely omit sending group claims in the token. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] If the 1,000-group limit for filtering is exceeded, filtering does not apply and an overage claim is sent instead. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]

Comparisons and alternatives

[low] When using Microsoft Entra ID as the IdP with Group Id as the source attribute, enter the group's Object ID instead of the group's name. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md [source]

Facts and statements

[low] The MongoDB Atlas - SSO application requires custom attribute mappings in the SAML token attributes configuration to match its expected assertion format. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[medium] While a federated IdP is enabled in Atlas, all other authentication mechanisms are disabled. Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md, https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] Atlas routes users with email addresses using mapped domains to the associated IdP. Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md [source]
[low] Atlas supports SHA-1 and SHA-256 as signature algorithm values for SAML configurations. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] A linked IdP appears as Inactive in the Federation Management Console until at least one domain is mapped to it. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] Generating a valid SAML signing certificate for Microsoft Entra ID requires assigning temporary values to the Identifier and Reply URL for the enterprise application. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Configuring Microsoft Entra ID federation requires at least Cloud App Administrator and User Administrator privileges in the tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
[low] Using the federation resource requires an existing IdP linked to the Atlas organization and a connection secret with API credentials having OrganizationOwner permissions. Sources: https://www.mongodb.com/docs/atlas/operator/current/atlasfederatedauth-custom-resource.md [source]
[low] The Identifier URL must follow the pattern https://www.okta.com/saml2/service-provider/<Customer_Unique>. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] The Reply URL must follow the pattern https://auth.mongodb.com/sso/saml2/<Customer_Unique>. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] The Sign-on URL must follow the pattern https://cloud.mongodb.com/sso/<Customer_Unique>. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] MongoDB Atlas - SSO supports both SP-initiated and IDP-initiated SSO. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] The number of groups emitted in a token is limited to 150 for SAML assertions and 200 for JWT, including nested groups. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] Microsoft Entra Connect version 1.2.70 or later is required; earlier versions synchronize group objects but do not include required group name attributes. (verified as of 2026-10-14) Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] Microsoft Entra ID supports group filtering only if a user belongs to 1,000 or fewer groups, including direct and transitive memberships. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] If the option to emit group data as roles is used, only groups appear in the role claim, and any application roles assigned to the user are excluded. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] If the configured regex does not match any value in the original list, the custom claim is not present and the original groups claim is included in the token. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] In additionalProperties, only one of sam_account_name, dns_domain_and_sam_account_name, or netbios_domain_and_sam_account_name is required; if more than one is present, the first is used and others are ignored. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]
[low] The Organization Owner role should be heavily restricted and not assigned to a human due to its ability to change organization-wide settings and delete configurations. Sources: https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md [source]
[low] If a restricted name is selected for a custom group claim, the claim will be ignored at runtime. Sources: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims [source]

Related concepts

Entra — is a part of IdP configuration (Entra ID)
IdP — is a part of IdP configuration (Entra ID)
configuration — is a part of IdP configuration (Entra ID)

Children

No children recorded.

← the whole tree · 3D view· how to read this page