TopolearnShared Grafana instances hold sensitive data and production alerting; permissions keep them safe and tidy.
Grafana's permission model has several layers:
- Organizations: fully separate tenants inside one instance, each with its own dashboards, data sources and users. Many installations use just one.
- Basic roles per organization: Viewer (view dashboards, can use Explore only if allowed), Editor (create and edit dashboards and alerts), Admin (manage data sources, users and settings). Grafana server admins manage the whole instance.
- Teams group users; permissions are granted to teams rather than individuals.
- Folder permissions: dashboards and alert rules live in folders, and folders can grant View, Edit or Admin to roles, teams or users. A common pattern is one folder per team, editable by that team and viewable by everyone.
- Data source permissions and fine-grained role-based access control are available in Grafana Enterprise and Grafana Cloud.
Sign-in normally comes from an identity provider: OAuth/OIDC (Google, GitHub, Okta, Azure AD/Entra ID, generic OIDC), SAML or LDAP, with group-to-role or team mapping.
For automation, use service accounts with tokens, assigned the minimal role, instead of personal credentials. They replace the older API keys. Disable anonymous access unless a dashboard is truly public, and use public/shared dashboards for that instead.
Example
# grafana.ini excerpt: Generic OIDC login with role mapping
[auth.generic_oauth]
enabled = true
name = Company SSO
client_id = grafana
client_secret = $__env{OIDC_CLIENT_SECRET}
scopes = openid email profile groups
auth_url = https://sso.example.com/oauth2/authorize
token_url = https://sso.example.com/oauth2/token
api_url = https://sso.example.com/oauth2/userinfo
role_attribute_path = contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'sre') && 'Editor' || 'Viewer'
[auth.anonymous]
enabled = false
# Service account for CI (created in Administration > Service accounts):
# curl -H "Authorization: Bearer $GRAFANA_SA_TOKEN" https://grafana.example.com/api/search?type=dash-dbRemember
- Basic roles: Viewer, Editor, Admin per organization
- Grant folder permissions to teams, not individuals
- Automate with least-privilege service account tokens
Watch out for
- Giving everyone the Editor role so anyone can change production alert rules.