MongoDB Atlas on Azure
Parent: MongoDB Atlas · researched 2026-05-28T16:53:54.596Z· 28 sources · 36 concepts · skill mongodb-atlas-azure
Deep reference for MongoDB Atlas on Microsoft Azure covering Private Link and DNS architecture, Entra ID OIDC/LDAP identity federation and Managed Identity for Atlas authentication, Azure Key Vault BY
MongoDB Atlas on Azure — Networking, Identity & Integration
- Deep reference for MongoDB Atlas on Microsoft Azure covering Private Link and DNS architecture, Entra ID OIDC/LDAP identity federation and Managed Identity for Atlas authentication, Azure Key Vault BYOK encryption with key rotation and failsafe behavior, Atlas Kubernetes Operator on AKS with Workload Identity, Azure service integrations (OpenAI, Event Hub, Functions, App Service, Container Apps, Synapse), MACC and Azure Native MongoDB billing, Azure Monitor / Log Analytics / Sentinel observability, the complete Azure region map, Terraform and Bicep IaC patterns, and a full Azure-specific troubleshooting playbook. [source]
When to use this skill
- When configuring Atlas Private Link on Azure including private DNS zones, NSG rules, hub-and-spoke topology, Azure Private DNS Resolver, or ExpressRoute integration [source]
- When setting up Entra ID OIDC/LDAP federation, Managed Identity, or Workload Identity Federation for Atlas authentication [source]
- When implementing Azure Key Vault as Atlas Encryption at Rest (BYOK), including secretless authentication, key rotation, or KV Managed HSM [source]
- When deploying Atlas Kubernetes Operator (AKO) on AKS with Workload Identity or configuring KEDA / Dapr sidecar patterns [source]
- When integrating Atlas with Azure OpenAI embeddings / Vector Search, Event Hub Stream Processing, Azure Functions, or App Service [source]
- When evaluating MACC eligibility for Atlas spend, comparing ANM vs standard Atlas, or managing Azure Marketplace billing [source]
- When setting up Atlas log export to Log Analytics, Microsoft Sentinel, Application Insights, or OpenTelemetry [source]
- When designing Azure compliance architecture for Atlas deployments [source]
- When writing Terraform with the mongodbatlas + azurerm providers or Bicep templates [source]
- When troubleshooting Private Link DNS failures, NSG blocking, Entra ID token claim errors, or Key Vault access denials [source]
Private Link vs VNet Peering
- MongoDB recommends Private Endpoints (Azure Private Link) for new deployments over VNet peering. [source]
- Private Link DNS: SRV connection string resolves to pl-0-eastus2.<cluster-id>.mongodb.net - an A record pointing to the NIC's private IP. Private DNS Zone <cluster-id>.mongodb.net must be linked to every VNet needing resolution. [source]
- NSG Rules: SRV connection strings use high ports (1024-65535), not just 27017. Allow TCP 1024-65535 outbound to private endpoint subnet. [source]
- Hub-and-spoke: Place private endpoint in hub VNet; use Azure Private DNS Resolver (managed, HA) instead of BIND forwarder VMs. Link Private DNS Zone to ALL VNets including spokes. [source]
Workforce Identity Federation (OIDC) — GA June 2024
- Human users SSO into Atlas database access using Entra ID credentials. Issuer URI: https://login.microsoftonline.com/<tenant-id>/v2.0. [source]
Workload Identity Federation (OAuth 2.0) — GA June 2024
- Azure Managed Identities and Service Principals authenticate to Atlas without passwords using short-lived OAuth 2.0 tokens. Issuer URI: https://sts.windows.net/<tenant-id>/. [source]
AKS Workload Identity
- Add label azure.workload.identity/use: "true" to pod. Create federated credential linking AKS OIDC issuer + service account + audience api://AzureADTokenExchange. [source]
Secretless Authentication (Recommended)
- Atlas uses its own Azure Service Principal (atlasAzureAppId: 9efedfcc-2eca-4b27-a613-0cad1e114cb7). Grant it "Key Vault Crypto User" and "Reader" RBAC roles. [source]
Key Identifier Best Practice
- Use versionless key identifier (no trailing /<version>) so Atlas automatically uses the latest key version after rotation. [source]
Failsafe Behavior
- If AKV is inaccessible: running cluster continues (DEK cached in memory), but mongod will NOT restart. Create private endpoint for KV in EACH Atlas-deployed region. [source]
Azure Functions + Atlas
- Use maxPoolSize: 5 (low pool for horizontal scaling). Cold starts create new connections. Do NOT store client in async context - use module-level singleton. [source]
Azure Event Hub + Atlas Stream Processing
- Supported via Kafka-compatible endpoint. Standard tier: 20 consumer groups per hub. Each Atlas Stream Processor = 1 consumer group. Upgrade to Premium for many pipelines. [source]
Azure OpenAI + Atlas Vector Search
- Flagship integration as of 2024-2025. Azure OpenAI "on your data" has a native MongoDB Atlas data connector (API version 2024-08-01+). [source]
5. MACC and Azure Marketplace Billing
- MACC-eligible: Atlas purchased through Azure Marketplace (PAYG or committed-use). Direct MongoDB invoices are NOT MACC-eligible. [source]
- ANM (Azure Native MongoDB): Atlas as a first-party Azure resource type in Azure Portal. Billing on Azure invoice. Feature parity generally at parity with standard Atlas. [source]
6. Azure Monitoring and Observability
- Microsoft Sentinel: MongoDB Atlas Data Connector via Function App → Log Analytics → MDBALogTable_CL [source]
- Application Insights: OpenTelemetry MongoDB instrumentation package for distributed tracing [source]
- Azure Monitor: Function-based scraper of Atlas Metrics API → Custom Metrics Ingestion [source]
7. Atlas → Azure Region Mapping (Key Regions)
- AtlasGov (FedRAMP High): AZURE_US_GOV_VIRGINIA, AZURE_US_GOV_ARIZONA. Control plane: cloud.mongodbgov.com. [source]
8. IaC Patterns: Terraform + Bicep
- Use mongodbatlas provider v2.x + azurerm provider v3.x. For Private Endpoint: 4-step pattern - create Atlas endpoint service → Azure private endpoint → register with Atlas → create Private DNS Zone + VNet link + A record. [source]
- For Key Vault EAR: use versionless_id for the key identifier to enable automatic rotation pickup. [source]
9. Troubleshooting Playbook
- DNS resolution fails: Verify Private DNS Zone linked to VNet, A record exists, VM uses Azure DNS (168.63.129.16), no split-horizon conflict [source]
- Connection timeout: Check NSG allows TCP 1024-65535 outbound; verify disablePrivateEndpointNetworkPolicies setting [source]
- OIDC token rejected: Check iss claim matches exactly; verify aud matches Atlas IDP config; for workforce OIDC, verify groupMembershipClaims: "SecurityGroup" (>150 groups causes groups claim omission) [source]
- KV access denied: Verify "Key Vault Crypto User" + "Reader" RBAC; check KV network firewall; verify key not deleted [source]
- MACC not tracking: Must be Marketplace purchase; check 24-48hr billing lag; verify EA enrollment [source]
Common Anti-Patterns
- Using port 27017 in NSG rules with SRV connection strings (need 1024-65535) [source]
- Forgetting to link Private DNS Zone to every VNet in hub-and-spoke [source]
- Using same Entra ID app registration for both workforce and workload identity [source]
- Using Key Vault Access Policies instead of RBAC [source]
- Including key version in Atlas key identifier [source]
- Not creating KV private endpoint in every Atlas cluster region [source]
- Purchasing Atlas directly from MongoDB when MACC drawdown is needed [source]
References
Children
- Azure Private Link for Atlas (frontier)
- Atlas Private DNS Zones Azure (frontier)
- NSG Rules for Atlas (frontier)
- Hub-and-Spoke Atlas Networking (frontier)
- Azure Private DNS Resolver (frontier)
- ExpressRoute Atlas Connectivity (frontier)
- Entra ID OIDC Workforce Federation (frontier)
- Entra ID Workload Identity Federation (frontier)
- AKS Workload Identity Atlas (frontier)
- Atlas LDAP Azure AD DS (frontier)
- Atlas SAML Entra ID (frontier)
- Azure Key Vault Atlas BYOK (frontier)
- Atlas Secretless KV Authentication (frontier)
- Azure Key Vault RBAC Atlas (frontier)
- Atlas Key Rotation AKV (frontier)
- KMS Failsafe Behavior Atlas (frontier)
- AKS Atlas Kubernetes Operator (frontier)
- Azure Functions Atlas Connection Pooling (frontier)
- Azure Event Hub Atlas Stream Processing (frontier)
- Azure Service Bus Atlas Triggers (frontier)
- Azure App Service Atlas (frontier)
- Azure Container Apps Atlas (frontier)
- Azure Synapse Atlas Data Federation (frontier)
- Azure OpenAI Atlas Vector Search (frontier)
- Atlas MACC Eligibility (frontier)
- Azure Native MongoDB ANM (frontier)
- Azure Marketplace Atlas Billing (frontier)
- Atlas Sentinel Log Integration (frontier)
- Atlas Azure Monitor Metrics (frontier)
- Atlas Application Insights OTel (frontier)
- Atlas Azure Regions Mapping (frontier)
- AtlasGov Azure Government (frontier)
- Atlas Terraform Azure Provider (frontier)
- Atlas Bicep Private Endpoint (frontier)
- Atlas Azure Troubleshooting Playbook (frontier)
- Atlas Azure Security Compliance (frontier)
Frontier under this node: AKS Atlas Kubernetes Operator, AKS Workload Identity Atlas, Atlas Application Insights OTel, Atlas Azure Monitor Metrics, Atlas Azure Regions Mapping, Atlas Azure Security Compliance, Atlas Azure Troubleshooting Playbook, Atlas Bicep Private Endpoint, Atlas Key Rotation AKV, Atlas LDAP Azure AD DS, Atlas MACC Eligibility, Atlas Private DNS Zones Azure, Atlas SAML Entra ID, Atlas Secretless KV Authentication, Atlas Sentinel Log Integration, Atlas Terraform Azure Provider, AtlasGov Azure Government, Azure App Service Atlas, Azure Container Apps Atlas, Azure Event Hub Atlas Stream Processing, Azure Functions Atlas Connection Pooling, Azure Key Vault Atlas BYOK, Azure Key Vault RBAC Atlas, Azure Marketplace Atlas Billing, Azure Native MongoDB ANM, Azure OpenAI Atlas Vector Search, Azure Private DNS Resolver, Azure Private Link for Atlas, Azure Service Bus Atlas Triggers, Azure Synapse Atlas Data Federation, Entra ID OIDC Workforce Federation, Entra ID Workload Identity Federation, ExpressRoute Atlas Connectivity, Hub-and-Spoke Atlas Networking, KMS Failsafe Behavior Atlas, NSG Rules for Atlas