What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

When we create a new database user through Database & Network Access → Database Users → ADD NEW DATABASE USER, Atlas does not enforce any password validation. As a result, it is possible to set a password that does not meet basic security standards — for example, a password with only a single character. Because there is no system-level enforcement, weak passwords can be set unintentionally, which creates a security risk and a compliance gap against our internal security policy.

What would you like to see happen?

Describe the desired outcome or enhancement.

We would like Atlas to enforce password complexity validation at the point of creating (and updating) a database user. Ideally this validation would be configurable, but at minimum it should support the following criteria:
Minimum length of at least 8 charactersMust include all of the following character types: uppercase letters, lowercase letters, numbers, and special charactersIf the entered password does not meet the policy, Atlas should reject it with a clear error message before the user can be created. Where possible, allowing organization/project administrators to define or customize the password policy would be a valuable addition.

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

Our internal security policy requires that all service account passwords meet a defined complexity standard. Because Atlas does not currently validate passwords, the risk of a non-compliant or weak password being set is a real concern, and the responsibility for enforcement falls entirely on manual operational discipline. A built-in, system-level validation would close this gap, reduce the risk of human error, strengthen the overall security posture of our database accounts, and help us demonstrate compliance with our internal security requirements.

What steps, if any, are you taking today to manage this problem?

Today we rely on a fully manual process. When creating a service account, the responsible operator manually generates a password that complies with our internal security policy and enters it during user creation. There is no system check to confirm the password actually meets the policy, so we depend entirely on the operator following the rules correctly. This manual approach is error-prone and difficult to audit, which is why a system-level validation process is needed.