Docs Menu
Docs Home
/
MongoDB Atlas
/
Configure Security Features
/
Cloud Provider Access

Set Up and Manage Azure Service Principal Access

On this page

  • Overview
  • Required Access
  • Prerequisites
  • Set Up Azure Service Principal Access
  • View Authorized Azure Service Principals
  • View Authorized Azure Service Principal Details
  • Remove Authorized Azure Service Principal

Overview

Some Atlas features such as Data Federation require access to resources in your Azure Blob Storage environment. To grant access in a secure manner, create or update an Azure Service Principal with access policy.

Required Access

To configure customer key management, you must have Project Owner access to the project.

Users with Organization Owner access must add themselves to the project as a Project Owner.

Prerequisites

Set Up Azure Service Principal Access

You can set up an Azure service principal with access policy for your Atlas project from the Atlas Administration API or Atlas UI.

You can use the Azure PowerShell or CLI to set up the Service Principal.

1

In Atlas, go to the Project Integrations page.

  1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. Next to the Projects menu, expand the Options menu, then click Integrations.

    The Project Integrations page displays.

2

Configure Azure Service Principal access.

Click Configure for Azure.

Atlas displays the Authorize Azure Service Principal page the first time. Subsequently, Atlas displays the Azure Service Principal Access page.

3

Start the configuration for Atlas to access your Azure account.

  1. Click Authorize Azure Service Principal.

  2. Review the information in the Overview and click Next.

4

Assign Atlas a relationship to your Azure account.

The Add Atlas to your Azure Service Principal section displays the AppId that you can use with your command to create your new or add to existing Service Principal for Atlas. You can use either Azure PowerShell or CLI to create or update the Service Principal. To create a new Service Principal, you can follow the step in the Authorize Azure Service Principal window.

  1. In a terminal, log into PowerShell and get the tenant ID using the commands displayed in the UI.

  2. Enter the ID of your Azure Active Directory tenant in the UI text field.

  3. Copy and run the PowerShell command displayed in the UI in your PowerShell to create a new Service Principal for Atlas.

    Atlas automatically uses the AppId displayed in the Add Atlas to your Azure Service Principal section as the value for the -AppId option.

  4. Enter the ID of the service principal that you created.

    The service principal ID is the value of the ObjectId field in your PowerShell command output.

  1. Get the ID of your Azure Active Directory tenant using the displayed command and enter the tenant ID returned by the command in the text field in the UI.

  2. Copy and run the displayed command in the Azure CLI to create a new Service Principal for Atlas.

    Atlas automatically uses the AppId displayed in the Add Atlas to your Azure Service Principal section as the value for --id option.

  3. Enter the ID of the service principal that you created.

    The service principal ID is the value of the id field in the command output.

5

Click Validate and Finish to allow Atlas to establish the relationship.

To create an Azure service principal with access policy for your Atlas project through the API, send POST requests to the cloudProviderAccess endpoint first with the ID of the project for which you wish to create a service principal and then with the ID of the project and service principal for which you set up access. To learn more about the request path and body parameters, see Create One Cloud Provider Access Role and Authorize One Cloud Provider Access Role.

View Authorized Azure Service Principals

You can view all Azure service principals for your Atlas project from the Atlas Administration API or Atlas UI.

1

In Atlas, go to the Project Integrations page.

  1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. Next to the Projects menu, expand the Options menu, then click Integrations.

    The Project Integrations page displays.

2

View the authorized Azure service principals.

The Azure Service Principal Access page displays. The page displays the list of services principals configured for your project. For each service principal, the page displays the following:

Field Name
Description

Service Principal

The ID of the service principal.

Created Date

The date when you created and associated the service principal with Atlas.

Actions

The actions that you can take on the associated service principal. You can do the following:

  • Click to remove the service principal authorization for Atlas.

  • Click to view service principal details or create a federated database instance.

To view all the Azure service principals with access policy for your Atlas project through the API, send a GET request to the cloudProviderAccess endpoint with the ID of the project. To learn more about the syntax and parameters to include in the request, see Return All Cloud Provider Access Roles.

View Authorized Azure Service Principal Details

You can view the details of an authorized Azure Service Principal from the Atlas Administration API or Atlas UI.

1

In Atlas, go to the Project Integrations page.

  1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. Next to the Projects menu, expand the Options menu, then click Integrations.

    The Project Integrations page displays.

2

View the authorized Azure service principals.

The Azure Service Principal Access page displays. The page displays the list of services principals configured for your project.

3

Click the ellipsis () for the Service Principal and select View Service Principal Details from the dropdown.

Atlas displays the Service Principal Details window. You can view and copy the following information about the authorized Service Principal:

Field Name
Description

Atlas Azure AppID

The ID of the Atlas Azure application.

Tenant ID

The ID of of your Azure Active Directory tenant

Service Principal ID

The ID of the service principal.

4

Click Close to close the window.

To view an Azure service principal with access policy for your Atlas project through the API, send a GET request to the cloudProviderAccess endpoint with the ID of the project. To learn more about the syntax and parameters to include in the request, see Return specified Cloud Provider Access Role.

Remove Authorized Azure Service Principal

You can't remove a Service Principal that is currently in use. You can remove unused Azure Service Principals from the Atlas Administration API or Atlas UI.

1

In Atlas, go to the Project Integrations page.

  1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. Next to the Projects menu, expand the Options menu, then click Integrations.

    The Project Integrations page displays.

2

View the authorized Azure service principals.

The Azure Service Principal Access page displays. The page displays the list of services principals configured for your project.

3

Click the for the Service Principal that you wish to remove.

Atlas displays a confirmation window.

4

Enter the ID of the Service Principal that is shown in the window and click Delete to remove it.

To remove an Azure service principal with access policy for your Atlas project through the API, send a DELETE request to the cloudProviderAccess endpoint with the ID of the project, the name of the cloud provider, and the ID of the service principal that you wish to remove. To learn more about the syntax and parameters to include in the request, see Deauthorize One Cloud Provider Access Role.

Back

Unified AWS

Next

GCP Service Account