MongoDB Atlas on Azure
Parent: MongoDB Atlas · Published reference · snapshot 2026-09-08 · skill mongodb-atlas-expert/references/mongodb-atlas-azure.md
↓ Facts as markdownall context files
Deep reference for MongoDB Atlas on Microsoft Azure covering Private Link and DNS architecture, Entra ID OIDC/LDAP identity federation and Managed Identity for Atlas authentication, Azure Key Vault BY
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
MongoDB Atlas on Azure — Networking, Identity & Integration
- Deep reference for MongoDB Atlas on Microsoft Azure covering Private Link and DNS architecture, Entra ID OIDC/LDAP identity federation and Managed Identity for Atlas authentication, Azure Key Vault BYOK encryption with key rotation and failsafe behavior, Atlas Kubernetes Operator on AKS with Workload Identity, Azure service integrations (OpenAI, Event Hub, Functions, App Service, Container Apps, Synapse), MACC and Azure Native MongoDB billing, Azure Monitor / Log Analytics / Sentinel observability, the complete Azure region map, Terraform and Bicep IaC patterns, and a full Azure-specific troubleshooting playbook. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#mongodb-atlas-on-azure-networking-identity-integration]
When to use this skill
- When configuring Atlas Private Link on Azure including private DNS zones, NSG rules, hub-and-spoke topology, Azure Private DNS Resolver, or ExpressRoute integration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When setting up Entra ID OIDC/LDAP federation, Managed Identity, or Workload Identity Federation for Atlas authentication [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When implementing Azure Key Vault as Atlas Encryption at Rest (BYOK), including secretless authentication, key rotation, or KV Managed HSM [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When deploying Atlas Kubernetes Operator (AKO) on AKS with Workload Identity or configuring KEDA / Dapr sidecar patterns [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When integrating Atlas with Azure OpenAI embeddings / Vector Search, Event Hub Stream Processing, Azure Functions, or App Service [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When evaluating MACC eligibility for Atlas spend, comparing ANM vs standard Atlas, or managing Azure Marketplace billing [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When setting up Atlas log export to Log Analytics, Microsoft Sentinel, Application Insights, or OpenTelemetry [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When designing Azure compliance architecture for Atlas deployments [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When writing Terraform with the mongodbatlas + azurerm providers or Bicep templates [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
- When troubleshooting Private Link DNS failures, NSG blocking, Entra ID token claim errors, or Key Vault access denials [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#when-to-use-this-skill]
Private Link vs VNet Peering
- MongoDB recommends Private Endpoints (Azure Private Link) for new deployments over VNet peering. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#private-link-vs-vnet-peering]
- Private Link DNS: SRV connection string resolves to pl-0-eastus2.<cluster-id>.mongodb.net - an A record pointing to the NIC's private IP. Private DNS Zone <cluster-id>.mongodb.net must be linked to every VNet needing resolution. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#private-link-vs-vnet-peering]
- NSG Rules: SRV connection strings use high ports (1024-65535), not just 27017. Allow TCP 1024-65535 outbound to private endpoint subnet. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#private-link-vs-vnet-peering]
- Hub-and-spoke: Place private endpoint in hub VNet; use Azure Private DNS Resolver (managed, HA) instead of BIND forwarder VMs. Link Private DNS Zone to ALL VNets including spokes. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#private-link-vs-vnet-peering]
Workforce Identity Federation (OIDC) — GA June 2024
- Human users SSO into Atlas database access using Entra ID credentials. Issuer URI: https://login.microsoftonline.com/<tenant-id>/v2.0. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#workforce-identity-federation-oidc-ga-june-2024]
Workload Identity Federation (OAuth 2.0) — GA June 2024
- Azure Managed Identities and Service Principals authenticate to Atlas without passwords using short-lived OAuth 2.0 tokens. Issuer URI: https://sts.windows.net/<tenant-id>/. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#workload-identity-federation-oauth-20-ga-june-2024]
AKS Workload Identity
- Add label azure.workload.identity/use: "true" to pod. Create federated credential linking AKS OIDC issuer + service account + audience api://AzureADTokenExchange. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#aks-workload-identity]
Secretless Authentication (Recommended)
- Atlas uses its own Azure Service Principal (atlasAzureAppId: 9efedfcc-2eca-4b27-a613-0cad1e114cb7). Grant it "Key Vault Crypto User" and "Reader" RBAC roles. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#secretless-authentication-recommended]
Key Identifier Best Practice
- Use versionless key identifier (no trailing /<version>) so Atlas automatically uses the latest key version after rotation. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#key-identifier-best-practice]
Failsafe Behavior
- If AKV is inaccessible: running cluster continues (DEK cached in memory), but mongod will NOT restart. Create private endpoint for KV in EACH Atlas-deployed region. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#failsafe-behavior]
Azure Functions + Atlas
- Use maxPoolSize: 5 (low pool for horizontal scaling). Cold starts create new connections. Do NOT store client in async context - use module-level singleton. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#azure-functions-atlas]
Azure Event Hub + Atlas Stream Processing
- Supported via Kafka-compatible endpoint. Standard tier: 20 consumer groups per hub. Each Atlas Stream Processor = 1 consumer group. Upgrade to Premium for many pipelines. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#azure-event-hub-atlas-stream-processing]
Azure OpenAI + Atlas Vector Search
- Flagship integration as of 2024-2025. Azure OpenAI "on your data" has a native MongoDB Atlas data connector (API version 2024-08-01+). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#azure-openai-atlas-vector-search]
5. MACC and Azure Marketplace Billing
- MACC-eligible: Atlas purchased through Azure Marketplace (PAYG or committed-use). Direct MongoDB invoices are NOT MACC-eligible. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#5-macc-and-azure-marketplace-billing]
- ANM (Azure Native MongoDB): Atlas as a first-party Azure resource type in Azure Portal. Billing on Azure invoice. Feature parity generally at parity with standard Atlas. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#5-macc-and-azure-marketplace-billing]
6. Azure Monitoring and Observability
- Microsoft Sentinel: MongoDB Atlas Data Connector via Function App → Log Analytics → MDBALogTable_CL [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#6-azure-monitoring-and-observability]
- Application Insights: OpenTelemetry MongoDB instrumentation package for distributed tracing [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#6-azure-monitoring-and-observability]
- Azure Monitor: Function-based scraper of Atlas Metrics API → Custom Metrics Ingestion [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#6-azure-monitoring-and-observability]
7. Atlas → Azure Region Mapping (Key Regions)
- AtlasGov (FedRAMP High): AZURE_US_GOV_VIRGINIA, AZURE_US_GOV_ARIZONA. Control plane: cloud.mongodbgov.com. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#7-atlas-azure-region-mapping-key-regions]
8. IaC Patterns: Terraform + Bicep
- Use mongodbatlas provider v2.x + azurerm provider v3.x. For Private Endpoint: 4-step pattern - create Atlas endpoint service → Azure private endpoint → register with Atlas → create Private DNS Zone + VNet link + A record. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#8-iac-patterns-terraform-bicep]
- For Key Vault EAR: use versionless_id for the key identifier to enable automatic rotation pickup. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#8-iac-patterns-terraform-bicep]
9. Troubleshooting Playbook
- DNS resolution fails: Verify Private DNS Zone linked to VNet, A record exists, VM uses Azure DNS (168.63.129.16), no split-horizon conflict [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#9-troubleshooting-playbook]
- Connection timeout: Check NSG allows TCP 1024-65535 outbound; verify disablePrivateEndpointNetworkPolicies setting [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#9-troubleshooting-playbook]
- OIDC token rejected: Check iss claim matches exactly; verify aud matches Atlas IDP config; for workforce OIDC, verify groupMembershipClaims: "SecurityGroup" (>150 groups causes groups claim omission) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#9-troubleshooting-playbook]
- KV access denied: Verify "Key Vault Crypto User" + "Reader" RBAC; check KV network firewall; verify key not deleted [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#9-troubleshooting-playbook]
- MACC not tracking: Must be Marketplace purchase; check 24-48hr billing lag; verify EA enrollment [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#9-troubleshooting-playbook]
Common Anti-Patterns
- Using port 27017 in NSG rules with SRV connection strings (need 1024-65535) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Forgetting to link Private DNS Zone to every VNet in hub-and-spoke [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Using same Entra ID app registration for both workforce and workload identity [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Using Key Vault Access Policies instead of RBAC [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Including key version in Atlas key identifier [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Not creating KV private endpoint in every Atlas cluster region [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
- Purchasing Atlas directly from MongoDB when MACC drawdown is needed [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#common-anti-patterns]
References
- MongoDB Atlas Private Endpoint Management [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#references]
- Atlas Secretless Azure Key Vault Authentication [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#references]
- Atlas Workforce Identity Federation (OIDC) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#references]
- Deploy MongoDB Atlas in Azure - Azure Architecture Center [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-azure/#references]
Where this helps
- Standing up Atlas Private Link on Azure with correct private DNS zone and NSG configuration in a hub-and-spoke VNet topology. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Federating Entra ID identity into Atlas for both human (Workforce OIDC) and workload (Managed Identity/OAuth 2.0) authentication. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Configuring Azure Key Vault as the BYOK encryption-at-rest provider for an Atlas cluster, including secretless authentication via Atlas's own service principal. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Deploying the Atlas Kubernetes Operator on AKS using Workload Identity instead of static credentials. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Project ideas
- Deploy Atlas Private Link into a hub VNet with Azure Private DNS Resolver, then link the Private DNS Zone to every spoke VNet and verify resolution from each one. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Set up Workforce OIDC federation against Entra ID for Atlas database access, and separately configure Workload Identity Federation for an AKS-hosted service, to see how the two flows differ end-to-end. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Configure Azure Key Vault as BYOK encryption-at-rest using a versionless key identifier, then rotate the key and confirm Atlas picks up the new version automatically. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Build a Microsoft Sentinel pipeline that ingests Atlas audit logs via the MongoDB Atlas Data Connector (Function App → Log Analytics) for SIEM visibility. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Common mistakes
- Writing NSG rules that only allow port 27017 for an SRV connection string, when Atlas SRV records return high ports (1024–65535) that also need to be allowed outbound. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Forgetting to link the Private DNS Zone to every VNet in a hub-and-spoke topology, leaving some spokes unable to resolve the cluster hostname. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Reusing the same Entra ID app registration for both workforce and workload identity, which conflates two authentication flows that should be configured independently. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Including a key version in the Atlas Key Vault key identifier instead of using a versionless identifier, which breaks automatic pickup of a rotated key. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Known issues
- If Azure Key Vault becomes inaccessible, a running cluster continues operating because the data encryption key is cached in memory, but mongod will not restart — a private endpoint for Key Vault is needed in every Atlas-deployed region to avoid this. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Entra ID's groupMembershipClaims can omit the groups claim entirely once a user belongs to more than roughly 150 security groups, which silently breaks workforce OIDC group-to-role mapping. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- MACC eligibility depends on purchase channel: only Atlas purchased through the Azure Marketplace counts toward MACC, and Marketplace billing can lag 24–48 hours before it shows up. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- AtlasGov (FedRAMP High) regions and their control plane (cloud.mongodbgov.com) are a separate deployment target from commercial Atlas on Azure and need to be planned for explicitly, not assumed compatible. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Children
- Azure Private Link for Atlas (frontier, viability 4.05 / 5)
- Atlas Private DNS Zones Azure
- NSG Rules for Atlas (frontier, viability 3.55 / 5)
- Hub-and-Spoke Atlas Networking
- Azure Private DNS Resolver
- ExpressRoute Atlas Connectivity (frontier, viability 3.73 / 5)
- Entra ID OIDC Workforce Federation (frontier, viability 3.65 / 5)
- Entra ID Workload Identity Federation (frontier, viability 3.77 / 5)
- AKS Workload Identity Atlas
- Atlas LDAP Azure AD DS
- Atlas SAML Entra ID (frontier, viability 3.75 / 5)
- Azure Key Vault Atlas BYOK (frontier, viability 3.95 / 5)
- Atlas Secretless KV Authentication
- Azure Key Vault RBAC Atlas
- Atlas Key Rotation AKV (frontier, viability 4.08 / 5)
- KMS Failsafe Behavior Atlas (frontier, viability 3.83 / 5)
- AKS Atlas Kubernetes Operator
- Azure Functions Atlas Connection Pooling (frontier, viability 4.03 / 5)
- Azure Event Hub Atlas Stream Processing (frontier, viability 3.75 / 5)
- Azure Service Bus Atlas Triggers (frontier, viability 3.17 / 5, below research gate)
- Azure App Service Atlas (frontier, viability 3.73 / 5)
- Azure Container Apps Atlas (frontier, viability 3.80 / 5)
- Azure Synapse Atlas Data Federation
- Azure OpenAI Atlas Vector Search
- Atlas MACC Eligibility
- Azure Native MongoDB ANM
- Atlas Sentinel Log Integration (frontier, viability 2.88 / 5, below research gate)
- Atlas Azure Monitor Metrics (frontier, viability 2.88 / 5, below research gate)
- Atlas Application Insights OTel (frontier, viability 3.33 / 5)
- Atlas Azure Regions Mapping
- AtlasGov Azure Government
- Atlas Terraform Azure Provider (frontier, viability 2.67 / 5, below research gate)
- Atlas Bicep Private Endpoint
- Atlas Azure Troubleshooting Playbook (frontier, viability 2.60 / 5, below research gate)
- Atlas Azure Security Compliance (frontier, viability 2.75 / 5, below research gate)
- Atlas Billing Mechanics and Cost Visibility
Frontier under this node: Atlas Application Insights OTel (3.33), Atlas Azure Monitor Metrics (2.88), Atlas Azure Security Compliance (2.75), Atlas Azure Troubleshooting Playbook (2.60), Atlas Key Rotation AKV (4.08), Atlas SAML Entra ID (3.75), Atlas Sentinel Log Integration (2.88), Atlas Terraform Azure Provider (2.67), Azure App Service Atlas (3.73), Azure Container Apps Atlas (3.80), Azure Event Hub Atlas Stream Processing (3.75), Azure Functions Atlas Connection Pooling (4.03), Azure Key Vault Atlas BYOK (3.95), Azure Marketplace Atlas Billing, Azure Private Link for Atlas (4.05), Azure Service Bus Atlas Triggers (3.17), Entra ID OIDC Workforce Federation (3.65), Entra ID Workload Identity Federation (3.77), ExpressRoute Atlas Connectivity (3.73), KMS Failsafe Behavior Atlas (3.83), NSG Rules for Atlas (3.55)