Issue
Customers using Azure may already have Conditional Access policies in place or may need to establish new ones to restrict access to internal resources within Entra ID and their Azure subscription by specific public IP addresses. If the correct public IP addresses required for encryption at rest are not properly allowed, these policies can prevent MongoDB Atlas clusters from being accessible, as both the Atlas Control Plane and Data Plane are unable to validate the Azure Key Vault.
Cause
The Atlas Control Plane and Atlas Data Plane (Atlas cluster nodes) require access to the service principal to consume the Access Token to use and validate the Azure Key Vault and the Customer Managed Key (CMK).
Note: When using a Private Endpoint for encryption at rest, encryption and decryption actions are performed through the Azure Private Endpoint. However, the Access Token exchange is performed over the Internet. Therefore, the Atlas Control Plane and Atlas Data Plane IP addresses must not be blocked by the Azure Conditional Access Policy.
Steps to Resolve
Ensure ALL outbound Atlas Control Plane public IPs are not blocked as part of your Conditional Access Policy. Use the
Return All Control Plane IP AddressesAPI endpoint to retrieve a list of inbound and outbound Atlas Control Plane IP addresses in CIDR notation. For additional guidance, see the What inbound and outbound IP addresses are required for Encryption at Rest using CMK with a cloud provider's KMS? article.Ensure the cluster nodes' public IPs are not blocked as part of your Conditional Access Policy. See the How to find the public IP address of each host in an Atlas deployment article for more details.
If errors persist after completing these steps, open a MongoDB Support case for further assistance.