JIT user provisioning
Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15 · viability 3.15 / 5 (skip)
↓ Facts as markdownall context files
Depth-first rabbithole dossier for JIT user provisioning; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- [low] When an organization uses Role Mapping to manage Atlas user access through Identity Provider groups, a federated user's permissions in Atlas only update when that user logs in. Sources: https://www.mongodb.com/docs/atlas/app-connections.md [source]
Facts and statements
- [low] MongoDB Atlas supports just-in-time (JIT) user provisioning, which is enabled by default. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
- [low] Atlas SSO supports JIT provisioning, meaning a user provisioned from SSO can only be updated on login, including their group assignments. (verified as of 2026-10-14) Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 [source]
- [low] The Okta MongoDB integration supports SAML-based Single Sign-On (SSO) and SCIM-based automated user provisioning, allowing IT teams to centralize account lifecycle management and automatically govern project, organization, and operational role entitlements. Sources: https://www.okta.com/integrations/mongodb-atlas/ [source]
- [low] If a user does not already exist in MongoDB Atlas, a new user account is created after successful authentication. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
- [low] If a user's Identity Provider (IdP) group elevation expires, the change is not updated in Atlas until the user re-authenticates. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 [source]
Related concepts
- user — is a part of JIT user provisioning
- provisioning — is a part of JIT user provisioning
- JIT — is a part of JIT user provisioning
Children
- No children recorded.