LBAC for data sources - logs

Generally AvailableData sourcesLogsAuthentication and authorization

Release date: 2025-02-28

It can be hard for teams to collaborate on dashboards when they have to use different data sources. Grafana instances can become cluttered and confusing with hundreds of data sources.

LBAC (Label Based Access Control) for data sources - logs (previously called Team LBAC) is our first step towards seamless management of access for Loki logs. Each team views the same data source filtered by their team’s label permissions.

Feature highlights

Teams can view queries to the same data source with different LBAC rules applied
Configurable using the API and the UI
Simplified LBAC notation is automatically converted into correct custom headers

Best practices

We recommend you only add query permissions for teams that will have LBAC rules and remove default Viewer and Editor query permissions.
As an initial setup, we recommend defining as few rules as possible for each team, making sure that they’re additive rather than negating one another.
For validating rules, we recommend testing each rule in Loki Explore view. This allows you to see the logs that would be returned for the specific rule.