This tutorial was written by Darshan Jayarama.

MongoDB offers enterprise authentication, which includes LDAP, Kerberos, and x.509 certificates. These are widely accepted but require extensive infrastructure setup, complex certificate management, and domain dependency. If your organization is moving towards a cloud-native and SaaS based environment, managing traditional authentication systems at scale can be difficult.

This is the reason we lean towards implementing OIDC authentication. It is integrated with Active Directory, a token-based auth protocol, and a modern solution built on top of OAuth that provides SSO with a cloud identity provider such as Microsoft Entra ID. For modern solutions like Atlas, OIDC is a scalable, easy-to-set-up, and cloud-friendly approach that improves the security and user experience.

 Understanding the Architecture:

Let’s understand how authentication flows between Entra ID and Atlas.

In our current setup:

  • Microsoft Entra ID acts as the Identity Provider(IdP)
  • MongoDB Atlas is a service provider
  • OIDC tokens are used to establish trust and validate the identity

When a user attempts to access Atlas:

  1. Atlas redirects the authentication to Microsoft Entra ID
  2. User completes the Authentication (via browser or token-based)
  3. Entra ID generates the OIDC token
  4. Atlas validates that token
  5. Atlas maps the authenticated user to MongoDB roles and privileges.

User → Microsoft Entra ID → OIDC Token → MongoDB Atlas → Authorized Access

Implementation

Prerequisites:

In Microsoft Entra ID

  • Make sure you have Microsoft Entra Admin Center access
  • Permission to register enterprise applications
  • Ability to create client secrets
  • Permission to configure token claims and API permissions

In MongoDB Atlas

Application Registration in Entra ID:

The application has to be registered inside Microsoft Entra ID, which establishes trust between Entra ID and Atlas. You can follow the official documentation, as this is specific to registering MongoDB Atlas, or talk with the Azure admin team to register the application and ask them to share it.

Once you have finished the above step, copy the Object ID, which will be required for the next steps.

Configure OIDC in MongoDB Atlas:

In order to establish trust with Microsoft Entra ID as an Identity Provider (IdP), you must complete the identity configuration within MongoDB Atlas. This process links your Entra ID application registration with MongoDB Atlas Federated Authentication, enabling seamless Single Sign-On (SSO) and centralized access management.

Step 1: Configure OIDC IdP in Atlas:

  • Log in to MongoDB Atlas. You should have Organization Owner privilege.
  • Click on the organization you desire https://cloud.mongodb.com/v2#/preferences/organizations
  • Click on “Federation”, then “Open Federation Management App”.
  • Now click “Identity Providers”, then “Configure Identity Provider”.
  • Click on the “Allow software workloads …” button, then click Continue
  • Fill out the details:
    • Configuration Name: Any descriptive name for identification.
    • Configuration Description: Optional Description for this configuration
    • Issuer URI: Navigate to App registrations in Azure, search for the application you have created, and copy the value of Directory (tenant) ID highlighted in Yellow below. Paste the tenant ID in the placeholder: https://login.microsoftonline.com/TENANT_ID/v2.0
    • Client ID: From the same screenshot, you can copy the Client ID (highlighted in green). Paste it as is.
    • Audience: Same as above; paste the Client ID
    • Requested Scopes: Just place Client_ID value then .default ( CLIENT_ID/.default)

Leave the remaining fields as is, then hit Save and Finish.

Step 2: Create Entra group:

  • Go to Enterprise Applications All applications page
  • Search for the application that you created earlier and click on it.
  • Go to the “Users and Groups” tab in the left-hand panel:

  • Select Add user/group.
  • Fill out the details and click the Save button.

For more details, please follow the official Azure documentation.

Once the group is created, click on it to copy the Object ID of that group:

Step 3: Add Entra to Atlas Cluster:

  • Go to the Database & Network page in the cluster:

  • Fill in the details:
    • Identity provider is the application that we added at the organization level (from Step 1)
    • Group Identifier is the value you copied once we created the group in Entra (from Step 2)
    • Give a description as needed, and the rest of the fields are the same as a regular user

Once done, click the Add Group button.

Now we have added the group. In order to authenticate using this group. Go to the cluster page, click the Connect button to get the MongoDB URI:

Select the “Federated Auth” option and copy the connection string that is available.

In order to use this in Compass, you should be running MongoDB Compass version 1.49+. Once you use the Federated Auth URI, it will open a browser, and you should log in to your Microsoft Account.

After a successful login, you are all set to use the MongoDB cluster with OIDC Authentication.