Configure RBAC on Grafana Labs

Manage access using roles

Tue, 23 Jun 2026 13:06:40 +0000

Manage access using roles

In Grafana Enterprise and Grafana Cloud there are Basic, Fixed, and Custom roles.

Basic roles

There are four basic roles: Admin, Editor, Viewer, and None. Each basic role contains a number of fixed roles.

Details of the basic roles and the access they provide for Grafana Alerting are below.

Role	Access
Admin	Write access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), alert enrichments, and provisioning.
Editor	Write access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), alert enrichments, and provisioning.
Viewer	Read access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), and alert enrichments.
No basic role	A blank canvas to assign fixed or custom roles and craft permissions more precisely. For example, if you want to give a user the ability to see alert rules, but not notification settings, add No basic role and then the fixed role Rules reader.

Fixed roles

A fixed role is a group of multiple permissions.

Fixed roles provide users more granular access to create, view, and update Alerting resources than you would have with basic roles alone.

Details of the fixed roles and the access they provide for Grafana Alerting are below.

Display name in UI / Fixed role	Permissions	Description
Silences Writer: `fixed:alerting.instances:writer`	All permissions from `fixed:alerting.instances:reader` and `alert.instances:create` `alert.instances:write` for organization scope `alert.instances.external:write` for scope `datasources:*`	Add and update silences in Grafana and external providers.
Instances and Silences Reader: `fixed:alerting.instances:reader`	`alert.instances:read` for organization scope `alert.instances.external:read` for scope `datasources:*`	Read alert instances and silences in Grafana and external providers.
Notifications Writer: `fixed:alerting.notifications:writer`	All permissions from `fixed:alerting.notifications:reader`, `fixed:alerting.receivers:writer`, `fixed:alerting.templates:writer`, `fixed:alerting.time-intervals:writer`, `fixed:alerting.routes:writer`, `fixed:alerting.inhibition-rules:writer`, `fixed:alerting.notifications.external:writer`and `alert.notifications:write` for organization scope	Add, update, and delete notification policies and contact points in Grafana and external providers.
Notifications Reader: `fixed:alerting.notifications:reader`	All permissions from `fixed:alerting.receivers:reader`, `fixed:alerting.templates:reader`, `fixed:alerting.time-intervals:reader`, `fixed:alerting.routes:reader`, `fixed:alerting.inhibition-rules:reader`, `fixed:alerting.notifications.external:reader`and `alert.notifications:read` for organization scope	Read notification policies and contact points in Grafana and external providers.
Rules Writer: `fixed:alerting.rules:writer`	All permissions from `fixed:alerting.rules:reader` and `alert.rule:create` `alert.rule:write` `alert.rule:delete` `alert.silences:create` `alert.silences:write` for scope `folders:` `alert.rules.external:write` for scope `datasources:`	Create, update, and delete all alert rules and manage rule-specific silences.
Rules Reader: `fixed:alerting.rules:reader`	`alert.rule:read`, `alert.silences:read` for scope `folders:` `alert.rules.external:read` for scope `datasources:` `alert.notifications.time-intervals:read` `alert.notifications.receivers:list`	Read all alert rules and rule-specific silences in Grafana and external providers.
Full access: `fixed:alerting:writer`	All permissions from `fixed:alerting.rules:writer` `fixed:alerting.instances:writer` `fixed:alerting.notifications:writer`	Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers.
Full read-only access: `fixed:alerting:reader`	All permissions from `fixed:alerting.rules:reader` `fixed:alerting.instances:reader` `fixed:alerting.notifications:reader`	Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers.
Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader`	`alert.provisioning:read` and `alert.provisioning.secrets:read`	Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets.
Access to alert rules provisioning API: `fixed:alerting.provisioning:writer`	`alert.provisioning:read` and `alert.provisioning:write`	Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API.
Set provisioning status: `fixed:alerting.provisioning.provenance:writer`	`alert.provisioning.provenance:write`	Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.)
Contact Point Reader: `fixed:alerting.receivers:reader`	`alert.notifications.receivers:read` for scope `receivers:*`	Read all contact points.
Contact Point Creator: `fixed:alerting.receivers:creator`	`alert.notifications.receivers:create` `alert.notifications.receivers.test:create` for scope `receivers:uid:-`	Create a new contact point. The user is automatically granted full access to the created contact point.
Contact Point Writer: `fixed:alerting.receivers:writer`	All permissions from `fixed:alerting.receivers:creator` `alert.notifications.receivers:read`, `alert.notifications.receivers:write`, `alert.notifications.receivers:delete` and `alert.notifications.receivers.test:create` for scope `receivers:*`	Create a new contact point and manage all existing contact points.
Templates Reader: `fixed:alerting.templates:reader`	`alert.notifications.templates:read`	Read all notification templates.
Templates Writer: `fixed:alerting.templates:writer`	`alert.notifications.templates:read`, `alert.notifications.templates:write`, `alert.notifications.templates:delete`, `alert.notifications.templates.test:write`	Create new and manage existing notification templates. Test templates with custom payloads.
Time Intervals Reader: `fixed:alerting.time-intervals:reader`	`alert.notifications.time-intervals:read`	Read all time intervals.
Time Intervals Writer: `fixed:alerting.time-intervals:writer`	`alert.notifications.time-intervals:read`, `alert.notifications.time-intervals:write`, `alert.notifications.time-intervals:delete`	Create new and manage existing time intervals.
Notification Policies Reader: `fixed:alerting.routes:reader`	`alert.notifications.routes:read`	Read all notification policies.
Notification Policies Writer: `fixed:alerting.routes:writer`	`alert.notifications.routes:read` `alert.notifications.routes:write`	Create new and manage existing notification policies.
Inhibition Rules Reader: `fixed:alerting.inhibition-rules:reader`	`alert.notifications.inhibition-rules:read` for scope `inhibition-rules:*`	Read all inhibition rules.
Inhibition Rules Writer: `fixed:alerting.inhibition-rules:writer`	All permissions from `fixed:alerting.inhibition-rules:reader` and `alert.notifications.inhibition-rules:write`, `alert.notifications.inhibition-rules:delete` for scope `inhibition-rules:*`	Create, update, and delete all inhibition rules.
Full admin access: `fixed:alerting:admin`	All permissions from `fixed:alerting:writer` and `alert.notifications.receivers.permissions:read`, `alert.notifications.receivers.permissions:write`, `alert.notifications.receivers:readSecrets`, `alert.notifications.receivers:updateProtected` for scope `receivers:*`	Full write access in Grafana and all external providers, including their permissions, protected fields and secrets.
Enrichments Reader: `fixed:alerting.enrichments:reader`	`alert.enrichments:read`	Read all alert enrichment configurations.
Enrichments Writer: `fixed:alerting.enrichments:writer`	`alert.enrichments:read` `alert.enrichments:write`	Create new and manage existing alert enrichment configurations.
External Notifications Reader: `fixed:alerting.notifications.external:reader`	`alert.notifications.external:read` for scope `datasources:*`	Read notification policies and contact points in external providers.
External Notifications Writer: `fixed:alerting.notifications.external:writer`	All permissions from `fixed:alerting.notifications.external:reader` and `alert.notifications.external:write` for scope `datasources:*`	Add, update, and delete contact points and notification policies in external providers.

Create custom roles

Create custom roles of your own to manage permissions. Custom roles contain unique combinations of permissions, actions and scopes. Create a custom role when basic roles and fixed roles do not meet your permissions requirements.

For more information on creating custom roles, refer to Create custom roles.

Note
It is not recommended to create custom roles that include alerting.notifications.receiver actions with a scope other than receivers:*. The UID used in the scope is not stable and changes whenever a contact point is renamed.

Examples

The following examples give you an idea of how you can combine permissions for Grafana Alerting.

A custom role for read access to alert rules in folder F:

PUT access-control/roles
{
	"name": "custom:alert_rules_reader",
	"displayName": "Alert rule reader in folder F",
	"description": "Read access to rules in folder F that use DS1 and DS2",
	"permissions": [
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "folders:read",
        	"scope": "folders:uid:UID_F"
    	}
	]
}

A custom role for write access to alert rules that uses simplified routing:

PUT access-control/roles
{
	"name": "custom:alert_rules_updater",
	"displayName": "Alert rules editor in folder F",
	"description": "Edit access to rules in folder F that use DS1 and DS2",
	"permissions": [
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:write",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:create",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.notifications.receivers:list",
    	},
{
        	"action": "alert.notifications.time-intervals:read",
    	},
	]
}

Note
Delete the last two permissions if you aren’t using simplified notification routing.

Assign roles

To assign roles, complete the following steps.

Navigate to Administration > Users and access > Users, Teams, or Service Accounts.
Search for the user, team or service account you want to add a role for.
Select the role you want to assign.

Manage access using folders or data sources

Tue, 23 Jun 2026 13:06:40 +0000

Manage access using folders or data sources

You can extend the access provided by a role to alert rules and rule-specific silences by assigning permissions to individual folders or data sources.

Note
Data source query permissions are required to create an alert rule or modify an alert rule’s query using that data source.

This allows different users, teams, or service accounts to have customized access to modify or silence alert rules in specific folders or using specific data sources.

Details on the additional access provided by folder permissions are below.

Folder permission	Additional Access
View	Read access to all general silences. Read access to alert rules and their rule-specific silences only in the given folder and subfolders.
Edit	View access and write access to alert rules and their rule-specific silences only in the given folder and subfolders.
Admin	Same additional access as Edit.

Some example combinations:

Role	Folder permission	Access
No Basic Role	-	None. No access to alert rules or rule-specific silences in the folder.
No Basic Role	View	Read access to all general silences. Read access to alert rules and their rule-specific silences only in the given folder and subfolders.
No Basic Role	Edit	Above access and write access to alert rules (given necessary data source query permissions) and their rule-specific silences only in the given folder and subfolders.
Viewer	-	Read access to alert rules and silences in all folders.
Viewer	Edit	Read access to alert rules and silences in all folders. Write access to alert rules and their rule-specific silences only in the given folder and subfolders.
Editor	View	Read and write access to alert rules and silences in all folders. Access can only be extended.

Note
You can’t use folders to customize access to notification resources.

Folder permissions

To manage folder permissions, complete the following steps.

In the left-side menu, click Dashboards.
Choose the folder you want to add permissions for.

Note
It doesn’t matter which tab you’re on (Dashboards, Panels, or Alert rules); the folder permission you set applies to all.

Click Manage permissions from the Folder actions menu.
Update or add permissions as required.

Data source permissions

By default, users with the basic roles Admin, Editor, and Viewer roles have query access to data sources for Grafana Alerting.

If you used fixed roles or custom roles, you need to update data source permissions to create rules or update rule queries.

Alternatively, an administrator can assign the role Datasource Reader, which grants the user access to all data sources.

To manage data source permissions, complete the following steps.

In the left-side menu, click Connections > Data sources.
Click the data source you want to change the permissions for.
Click the Permissions tab.
In the Permission column, update the permission, or remove it by clicking X.

Configure silence access

Tue, 23 Jun 2026 13:06:40 +0000

Configure silence access

This article describes how Grafana Alerting controls access to silences and how to configure it for your teams. Use this article when you need to give some users full silence management while limiting others to silencing only their own rules.

Before you begin, ensure you have:

Admin access to the Grafana organization
Familiarity with Grafana RBAC and fixed roles

Silence types

Grafana Alerting has two types of silences:

General silences — not attached to any specific alert rule. They can match alerts from any rule in the organization. Only users with org-scoped silence permissions can create them.
Rule-specific silences — linked to a single alert rule via its UID. Access is controlled by the folder that contains the rule.

When you silence a firing alert directly from the alert list, Grafana creates a rule-specific silence automatically by adding the label matcher __alert_rule_uid__=<rule UID>. You can also create a rule-specific silence manually by including this matcher.

Silence permissions

Grafana has two independent sets of permissions for silences. They serve different purposes and apply to different scopes.

Org-scoped permissions

These permissions apply across the whole organization and cover both silence types.

Action	Description
`alert.instances:read`	Read all silences — general and rule-specific
`alert.instances:create`	Create any silence, including general silences
`alert.instances:write`	Update or expire any silence

The built-in Editor role includes all three via the fixed:alerting.instances:writer fixed role.

Folder-scoped permissions

These permissions are scoped to a specific folder. Users with only these permissions can manage rule-specific silences for rules in the granted folder, but can’t create general silences.

Action	Description
`alert.silences:read`	Read rule-specific silences for rules in the folder, plus all general silences org-wide
`alert.silences:create`	Create rule-specific silences for rules in the folder
`alert.silences:write`	Update or expire rule-specific silences for rules in the folder

Note
alert.silences:read always includes all general silences, regardless of the folder scope. General silences can suppress notifications for any rule, so users managing rules in a folder need to see silences that may affect their alerts.

Fixed roles

The following fixed roles are relevant to silence management.

Fixed role	Permissions	What it allows
`fixed:alerting.instances:writer` (Silences Writer)	`alert.instances:create`, `alert.instances:write` (org scope)	Create and manage general and rule-specific silences org-wide
`fixed:alerting.instances:reader` (Instances and Silences Reader)	`alert.instances:read` (org scope)	Read all silences
`fixed:alerting.rules:writer` (Rules Writer)	`alert.silences:create`, `alert.silences:write` for `folders:*`	Create and manage rule-specific silences
`fixed:alerting.rules:reader` (Rules Reader)	`alert.silences:read` for `folders:*`	Read rule-specific silences and all general silences

Folder permission mapping in Grafana OSS

In Grafana OSS, custom RBAC isn’t available. Instead, folder permissions automatically grant the corresponding silence access.

Folder permission	Silence access
View	Read all general silences; read rule-specific silences for rules in the folder
Edit	View access, plus create and update rule-specific silences for rules in the folder
Admin	Same as Edit

In Grafana Enterprise and Grafana Cloud, folder permissions grant the same silence access as in OSS, but you can go further by assigning folder-scoped RBAC permissions independently of rule access — for example, granting silence write access without granting rule write access.

Scenario: restrict users to rule-specific silences only

Use this setup when a team should be able to silence their own rules but must not create general silences that affect the whole organization.

Grant the following folder-scoped permissions for the team’s folder:

Permission	Scope
`alert.silences:read`	`folders:<FOLDER_UID>`
`alert.silences:create`	`folders:<FOLDER_UID>`
`alert.silences:write`	`folders:<FOLDER_UID>`

These permissions are included in fixed:alerting.rules:writer and are also granted automatically by the folder Edit permission.

Do not grant alert.instances:create or alert.instances:write at org scope — these allow creating general silences. They’re bundled into fixed:alerting.instances:writer and the built-in Editor role, so avoid assigning either to users who should be folder-restricted.

With this configuration:

Users can create silences only for rules in their folder.
Users can read all general silences.
Any attempt to create a general silence is rejected.

Scenario: grant full silence access

Use this setup for on-call engineers or administrators who need full control over all silences.

Assign the following fixed roles:

Fixed role	Grants
`fixed:alerting.instances:writer`	Create and manage general and rule-specific silences org-wide
`fixed:alerting.rules:writer`	Create and manage rule-specific silences across all folders

Alternatively, assign the built-in Editor role, which includes both.

With this configuration:

Users can create general silences for org-wide maintenance windows.
Users can create and expire rule-specific silences for any rule.
Users see all silences across the organization.

Security considerations

Keep the following in mind when configuring silence access.

Org-scoped write actions are powerful. Granting alert.instances:create or alert.instances:write at org scope — even to a user who otherwise has only folder-level access — allows them to create or modify silences that affect the entire organization. Review all custom and inherited roles that include these actions.
General silences are always visible to folder users. You can’t hide general silences from users who have any folder-scoped alert.silences:read permission. If general silences carry sensitive context (such as the name of an active incident), use clear, consistent naming conventions.
Use rule-specific silences for team isolation. In multi-team or multi-tenant deployments, rule-specific silences are the recommended pattern. They respect folder boundaries, which general silences don’t.

Next steps

Configure silences — create, edit, and expire silences
Manage access using roles — full reference for fixed and custom roles
Manage access using folders — folder-based access for alert rules and silences