Configure an External Identity Provider

Register an application

1. Navigate to App registrations.

   1. In your Azure portal account, search and click Microsoft Entra ID.

   2. In the Manage section of the left navigation, click App registrations.

2. Click New registration.

3. Apply the following values.

   Field	Value
   Name	MongoDB - Workload
   Supported Account Types	Accounts in this organizational directory only (single tenant)
   Redirect URI	Web

(Optional) Add groups claim

For application access, it is a best practice to use service principal identifiers as MongoDB user identifiers while defining access rights in self-managed MongoDB deployments. If you plan to use this common approach, skip this step. However, if you prefer to use group identifiers such as Azure AD Security Group identifier instead, you can set groups claim in your application registration with below steps.

1. Navigate to Token Configuration.

   In the Manage section of the left navigation, click Token Configuration.

2. Click Add groups claim.

3. In the Edit groups claim modal, select Security.

   What groups you select depend on the type of groups you configured in your Azure environment. You may need to select a different type of group to send the appropriate group information.

4. In the Customize token properties by type section, ensure that you only select Group ID.

   When you select Group ID, Azure sends the security group's Object ID.

5. Click Add.

   To learn more about adding a group claim, see Azure Documentation.

Enable an Application ID URI

1. Navigate to Expose an API in the left sidebar and enable Application ID URI.

2. Enable an Application ID URI.

   Keep the default Application ID URI assigned by Azure, which is <application_client_id>. Copy and store this value, as self-managed MongoDB deployments and all MongoDB drivers require this value for Workload Identity Federation configuration.

Update the manifest

1. In the Manage section of the left navigation, click Manifest.

2. Update the accessTokenAcceptedVersion from null to 2.

   The number 2 represents Version 2 of Microsoft's access tokens. Other applications can use this as proof of the Active Directory-managed user's identity. Version 2 ensures that the token is a JSON Web Token that MongoDB understands.

3. Click Save.

To learn more about adding an optional claim, see Azure Documentation.

Remember metadata

1. In the left navigation, click Overview.

2. In the top navigation, click Endpoints.

   Copy the OpenID Connect metadata document value, excluding /.well-known/openid-configuration.

   You can also retrieve this value by following the OpenID Connect metadata document URL and copying the value for issuer.

The following table shows what these Microsoft Entra ID UI values map to in the MongoDB oidcIdentityProviders parameter: