Multifactor authentication (MFA) verifies an identity with two or more independent factors, adding protection beyond a username and password. In Atlas, customers configure identity management and can enforce MFA for users accessing the Atlas UI. section 20.1 section 20.2
Atlas supports MFA as part of practical access-control configuration:
- Add MFA to username/password or federated authentication for Atlas UI access. section 20.2
- Enforce MFA for all users through SMS, voice calls, authentication applications, or hardware devices such as YubiKey. section 20.2
- Combine MFA with federated identity, network isolation, strong database authentication, and role-based access control for defense in depth. section 20.7
Enforcing MFA for Atlas UI users
An organization can authenticate Atlas UI users through an external identity provider, add MFA, and enforce it for every user. Database-cluster access remains separately governed through methods such as SCRAM, X.509 certificates, LDAP, or OpenID Connect. section 20.2
Table 20.2 Authentication features in Atlas
| Feature |
Description |
| Atlas Federated Authentication |
Supports login through external identity providers such as Okta, GitHub, Google, Ping Identity, and Microsoft Entra ID |
| Ensures secure database access with Salted Challenge Response Authentication Mechanism (SCRAM), X.509 certificates, LDAP, OpenID Connect (OIDC), and passwordless authentication with AWS IAM Integrates with HashiCorp Vault for dynamic user creation |
Use the authentication-features table to compare Atlas federated authentication with database authentication mechanisms and credential-management integrations. section 20.2
