• Security Features and Setup >
• Two Factor Authentication

Two Factor Authentication

Two-factor authentication provides a second layer of security for your Atlas account. If you enable 2FA for your account and after you enter your username and password, you are prompted for a six-digit time-sensitive verification code. This code is sent to a separate device, such as a mobile phone or security token, that you can read and enter into Atlas and complete your login.

Note

• An Atlas Organization Owner can require that all Atlas users within their organization enable 2FA for their Atlas accounts.

• If you login using your Google account:

  Google manages your 2FA. You can’t use Atlas two factor authentication and won’t be prompted for an Atlas 2FA verification when you log into Atlas. Google should verify your identity using Google 2-Step Verification

To learn more about organization settings, see Change Organization Settings.

Atlas provides the following sources for 2FA verification codes:

• Text or Voice
• 2FA App
• 2FA device

Text Messages (SMS)

When Atlas prompts you for a verification code, Atlas sends the 6-digit verification code using text (SMS) to the provided phone number.

The cellular carrier’s SMS rates apply.

Automated Voice Calls

When Atlas prompts you for a verification code, Atlas calls the provided phone number. An automated system repeats the 6-digit verification code a total of three times before hanging up.

The cellular carrier’s Voice Call rates apply.

Important

Voice only works in the US / Canada.

Note

Atlas users who operate within a geographic region with limited cellular service coverage or reliability may encounter delays in receiving the 2FA code via SMS or Voice. Consider using a 2FA app or device instead.

When Atlas prompts you for a verification code, you can provide one that is generated in a 2FA app. You must pair the 2FA app with Atlas first.

This tutorial uses the Google Authenticator mobile app.

There are other mobile device apps and web browser plug-ins that provide 2FA capabilities. You can use any that support the TOTP.

You can pair only one app with Atlas at any one time.

When Atlas prompts you for a verification code, you can provide one that is generated in a 2FA PIV device. You must pair the PIV device app with Atlas first using a 2FA app. These devices must support TOTP.

This procedure uses a YubiKey security key, specifically those that work with Authenticator Codes. Other 2FA PIV hardware devices that use TOTP should work in a similar fashion.

Informational Reference Only

MongoDB does not endorse the aforementioned service, and its reference is intended only as informational. Defer to your organization’s procedures in selecting the appropriate vendor or service for supporting 2FA via smart card or similar device.

Configure Two-Factor Authentication

1

Navigate to the Two-Factor Authentication page.

1. In the upper right corner of the Atlas UI, click your username to access the Account menu.
2. Under Atlas, click Two-Factor Authentication.

2

Enable Two-Factor Authentication.

Click Enable 2FA or pencil icon .

When prompted for verification:

• If you are setting up 2FA, enter your password.
• If you are editing your 2FA settings, enter a 2FA code.
• Click Verify.

4

Configure Voice/SMS Authentication.

1. Click Primary Method
2. Click Voice/SMS Number.
3. In the Enter your phone number box, enter your preferred mobile phone number.
4. Select your preferred method of receiving codes:
   • Text Message (SMS) or
   • Voice Call (US / Canada Only)
5. Click Verify.
6. Once you receive the verification code, enter that code into the into the Verify your code boxes. Each digit is entered in its own box.

Atlas automatically verifies the code and saves your settings.

1

Navigate to the Two-Factor Authentication page.

1. In the upper right corner of the Atlas UI, click your username to access the Account menu.
2. Under Atlas, click Two-Factor Authentication.

2

Enable Two-Factor Authentication.

Click Enable 2FA or pencil icon .

When prompted for verification:

• If you are setting up 2FA, enter your password.
• If you are editing your 2FA settings, enter a 2FA code.
• Click Verify.

3

Configure your Atlas 2FA settings.

1. Click Primary Method.
2. Click Google Authenticator.

4

On your mobile device or web browser, install Google Authenticator.

Although only Google Authenticator is displayed in the UI, any TOTP mobile app or web browser plug-in may be used.

Note

Wherever you see the phrase Google Authenticator in this procedure, you can substitute the name of your preferred 2FA app.

App	iOS	Android	Windows Phone	Blackberry
Google Authenticator	Link	Link
Duo Mobile	Link	Link	Link
Authy	Link	Link
Microsoft Authenticator	Link	Link	Link
Gauth				Link

5

Add Atlas to Google Authenticator.

1. Start Google Authenticator.

2. Click +.

3. Choose how to pair the Google Authenticator app with Atlas.

   • If your mobile device or web browser supports scanning barcodes, click Scan a barcode.

     Enable the device’s camera, if prompted, and point the device at the Atlas page to capture the barcode.

   • If your mobile device or web browser does not support scanning barcodes, or if you prefer to enter a key, click Enter provided key.

     1. Atlas displays the Atlas Account with a Key.

     2. In Google Authenticator, click Enter provided key then enter the account and key.

        (Duo Mobile, Authy and other apps have similar prompts.)

     After the barcode is scanned or account and key are entered, the Google Authenticator app produces a 6-digit code to verify the pairing.

4. Once you receive the verification code, enter that code into the into the Verify your code boxes. Each digit is entered in its own box.

Atlas automatically verifies the code and saves your settings.

See also

• Pairing third-party applications with Duo Mobile
• Pairing third-party applications with Authy
• Pairing third-party applications with Microsoft Authenticator

1

Download and install the Yubico Authenticator.

1. From a web browser, download the Yubico Authenticator application.
2. Double-click on the installer and follow the prompts.

2

Insert your Yubikey into a USB port.

3

Navigate to the Two-Factor Authentication page.

1. In the upper right corner of the Atlas UI, click your username to access the Account menu.
2. Under Atlas, click Two-Factor Authentication.

4

Enable Two-Factor Authentication.

Click Enable 2FA or pencil icon .

When prompted for verification:

• If you are setting up 2FA, enter your password.
• If you are editing your 2FA settings, enter a 2FA code.
• Click Verify.

5

Configure your Atlas 2FA settings.

1. Click Primary Method.
2. Click Google Authenticator.

6

Add Atlas to the Yubikey.

1. Start the Yubico Authenticator.

2. Make sure that your web browser is open to your Atlas Two-Factor Authentication modal with the Google Authenticator button selected.

3. From the File menu in Yubico Authenticator, select Scan QR code….

4. In the New credential dialog box, confirm the settings:

   Option	Accepted Value	Keep Default?
   Issuer	The name you want to display in the Yubico Authenticator application for Atlas.	Your choice
   Account name	Your Atlas username.	Yes
   Secret key	Token generated from the QR code.	Yes
   Type	Method that determines when to generate a new code.	Yes
   Algorithm	Encryption algorithm the token uses.	Yes
   Period	Duration that each verification code is valid.	Yes
   Digits	Number of digits in the verification code.	Yes
   Requires touch	Indicates user must be touching the contacts on the Yubikey when verification code is accepted.	User choice

5. Click Save credential.

   The verification code displays in Yubico Authenticator under the heading label you gave for the Issuer.

6. Once you receive the verification code, enter that code into the into the Verify your code boxes. Each digit is entered in its own box.

   Note

   You can copy the code from the Yubico Authenticator application. Click the Atlas service. then select Copy to Clipboard from the Edit menu.

Atlas automatically verifies the code and saves your settings.

Configure Backup Two Factor Authentication Phone Number

You can configure a backup phone number for receiving 2FA codes if the primary method fails or is unavailable.

If you have not yet enabled 2FA for the Atlas account, do so before proceeding. See Configure Two-Factor Authentication.

1

Navigate to the Two-Factor Authentication page.

1. In the upper right corner of the Atlas UI, click your username to access the Account menu.
2. Under Atlas, click Two-Factor Authentication.

2

Click edit icon for Two Factor Authentication.

Atlas requires a 2FA verification code to continue.

3

Configure a backup phone number.

1. Select Add a Backup Phone.
2. Enter your preferred phone number in the text entry.
3. Select your preferred method of receiving codes:
   • Text Message (SMS)
   • Voice Call (US / Canada Only)
4. Click Verify once you have configured your Voice/SMS authentication settings.
5. Click Save Changes.

Generate New Recovery Codes

Atlas can generate single-use recovery codes for use where all other methods of accessing the account fail. When you generate new recovery codes, you invalidate previously generated ones.

If you have not yet enabled 2FA for the Atlas account, do so before proceeding. See Configure Two-Factor Authentication.

1

Navigate to the Two-Factor Authentication page.

1. In the upper right corner of the Atlas UI, click your username to access the Account menu.
2. Under Atlas, click Two-Factor Authentication.

2

Select the edit button for Two Factor Authentication.

The edit button is pencil icon in Atlas.

3

Select Show Recovery Codes.

Reset Two Factor Authentication

In order to reset your two-factor authentication, you must:

• Be able to receive email at the address associated with your account.
• Have the database username and password for a project of which you are a member.
• Be a direct member of the project which your username and password correspond to. If you have access to the project only through a team that has a role in the project, you cannot reset two-factor authentication for your Atlas account.

Important

Resetting 2FA for an Atlas account disables 2FA for that account. You can re-configure 2FA after performing the reset procedure.

1. Log in to Atlas.

2. From the 2FA entry dialog, select Reset your two factor authentication.

3. Select Atlas user? Click here at the bottom of the Reset Two Factor Authentication modal.

4. Enter your Atlas username. Atlas emails a link to the email account associated with the Atlas username.

   Important

   The link to start the 2FA reset procedure is only active for two hours after Atlas sends the email. Make sure you click the link within the two-hour window.

5. Click the link in the email to start the 2FA reset procedure.

6. Follow the directions on the 2FA reset page. After completing the reset procedure, Atlas allows you to log in to the Atlas account without requiring a 2FA code.

←   Set up a Private Endpoint Set up User Authentication and Authorization with LDAP  →

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.