User management on Grafana Labs

Server user management

Fri, 07 Mar 2025 11:34:44 +0100

Server user management

A user is defined as any individual who can log in to Grafana. Each user is associated with a role that includes permissions. Permissions determine the tasks a user can perform in the system.

If you have server administrator permissions in Grafana, you can manage all users for a Grafana instance in the Server Admin section:

If you have organization administrator permissions and not server administrator permissions, refer to Manage users in a organization.

For more information about user roles and permissions, refer to Roles and permissions. For more information about managing users in general, see User management.

View a list of users

You can see a list of users with accounts on your Grafana server. This action might be useful when you want to know which role you assigned to each user.

Before you begin

Ensure you have Grafana server administrator privileges

To view a list of users:

Sign in to Grafana as a server administrator.
Hover your cursor over the Server Admin (shield) icon until a menu appears, and click Users.

Note: If you have organization administrator permissions and not server administrator permissions, you can still view of list of users in a given organization.

View user details

View user details when you want to see login, and organizations and permissions settings associated with a user.

Before you begin:

Ensure you have Grafana server administrator privileges

To view user details:

Sign in to Grafana as a server administrator.
Hover your cursor over the Server Admin (shield) icon until a menu appears, and click Users.
Click a user.

A user account contains the following sections.

User information

This section contains basic user information, which users can update.

Permissions

This indicates whether the user account has the Grafana administrator flag applied. If the flag is set to Yes, then the user is a Grafana server administrator.

Organizations

This section lists the organizations the user belongs to and their assigned role.

Sessions

This section includes recent user sessions and information about the time the user logged in and they system they used. You can force logouts, if necessary.

Edit a user account

Edit a user account when you want to modify user login credentials, or delete, disable, or enable a user.

Before you begin

Ensure you have Grafana server administrator privileges

To edit a user account:

Sign in to Grafana as a server administrator.
Hover your cursor over the Server Admin (shield) icon until a menu appears, and click Users.
Click a user.
Complete any of the following actions, as necessary.

Action	Description
Update name, email, or username	Is the user notified of these changes?. Click Save after you make a change.
Change the user’s password	The new password must be at least four characters long. Click Save after you make a change.
Delete a user	This action permanently removes the user from the Grafana server. The user can no longer sign in after you make this change.
Disable user account	This action prevents a user from signing in with this account, but does not delete the account. You might disable an account if a colleague goes on sabbatical.
Enable a user account	This action enables a user account.

Add a user

Add users when you want to manually provide individuals with access to Grafana.

When you create a user using this method, you must create their password. The user does not receive a notification by email. To invite a user to Grafana and allow them to create their own password, invite a user to join an organization.

When you configure advanced authentication using Oauth, SAML, LDAP, or the Auth proxy, users are created automatically.

Before you begin

Ensure that you have Grafana server administrator privileges

To add a user:

Sign in to Grafana as a server administrator.
Hover your cursor over the Server Admin (shield) icon until a menu appears, and click Users.
Click New user.
Complete the fields and click Create user.

When you create a user, the system assigns the user viewer permissions in a default organization, which you can change. You can now add a user to a second organization.

Note: If you have organization administrator permissions and not server administrator permissions, you can still add users by inviting a user to join an organization.

Force a user to log out of Grafana

If you suspect a user account is compromised or is no longer authorized to access the Grafana server, then you can force the user to log out of Grafana.

The force logout action can apply to one device that is logged in to Grafana, or all devices logged in to Grafana.

Before you begin

Ensure you have Grafana server administrator privileges

Sign in to Grafana as a server administrator.
Hover your cursor over the Server Admin (shield) icon until a menu appears, and click Users.
Click a user.
Scroll down to the Sessions section.
Perform one of the following actions:
- Click Force logout next to the session entry that you want logged out of Grafana.
- Click Force logout from all devices.
Confirm the logout.

Manage user preferences

Fri, 07 Mar 2025 11:34:44 +0100

Manage user preferences

Grafana allows you to manage certain aspects of your user account, including your user name, email, and password.

You can also view important information about your account, such as the organizations and roles to which you are assigned and the Grafana sessions associated with your account.

Change your Grafana password

You can change your Grafana password at any time.

Note: If your Grafana instance uses an external authentication provider, then you might not be able to change your password in Grafana. Contact your Grafana administrator for more information.

To change your password:

Sign in to Grafana.
Hover your mouse over the user icon in the lower-left corner of the page.
Click Change Password. Grafana opens the Change Password tab.
Enter your old password and a new password.
Confirm your new password.
Click Change Password.

Edit your profile

Your profile includes your name, user name, and email address, which you can update.

To edit your profile:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page and click Preferences.
In the Edit Profile section, update your profile and click Save.

Edit your preferences

You can choose the way you would like data to appear in Grafana, including the UI theme, home dashboard, timezone, and first day of the week. You can set these preferences for your own account, for a team, for an organization, or Grafana-wide using configuration settings. Your user preferences take precedence over team, organization, and Grafana default preferences. For more information, see Grafana preferences.

UI theme determines whether Grafana appears in light mode or dark mode. By default, UI theme is set to dark mode.
Home dashboard refers to the dashboard you see when you sign in to Grafana. By default, this is set to the Home dashboard.
Timezone is used by dashboards when you set time ranges, so that you view data in your timezone instead of UTC.
Week start is the first day of the week you want to use in dashboard time ranges, for example, This week.

To edit your preferences:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page, and click Preferences.
Update any of the values in the Preferences section.
Click Save at the bottom of the Preferences section.

Switch organizations

When you sign in to Grafana, the system signs you in to a default organization. If you are assigned to multiple organizations, then you might need to switch organizations. For example, if you need to view a dashboard not associated with your current organization, then you should switch organizations to view associated dashboards.

To switch organizations:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page and click Switch organization.
Next to the organization that you want to sign in to, click Switch to.

View your assigned organizations

Every user is a member of at least one organization. You can have different roles in each organization of which you are a member.

To view your assigned organizations:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page and click Preferences.
Scroll down to the Organizations section and review the following information:
- Name: The name of the organizations of which you are a member.
- Role: The role to which you are assigned in the organization. For more information about roles and permissions, refer to Organization users and permissions.
- Current: Grafana indicates the organization that you are currently signed into as Current. If you are a member of multiple organizations, you can click Select to switch to that organization.

View your Grafana sessions

Grafana logs your sessions in each Grafana instance. You can review this section if you suspect someone has misused your Grafana credentials.

To view your Grafana sessions:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page, and click Preferences.
Scroll down to the Sessions section.

Sign out a user session

You can sign out other sessions using your account in order to prevent other people from accessing Grafana using your credentials.

To sign out one of your Grafana sessions:

Sign in to Grafana.
Hover your cursor over the user icon in the lower-left corner of the page, and click Preferences.
Scroll down to the Sessions section.
Click the red “sign out” icon next to the session you would like to sign out.

Manage users in an organization

Fri, 07 Mar 2025 11:34:44 +0100

Manage users in an organization

Organization administrators can invite users to join their organization. Organization users have access to organization resources based on their role, which is Admin, Editor, or Viewer. Permissions associated with each role determine the tasks a user can perform in the system.

For more information about organization user permissions, refer to Organization users and permissions.

View a list of organization users

You can see a list of users with accounts in your Grafana organization. If necessary, you can use the search field to filter the list.

Before you begin

Ensure you have organization administrator privileges

To view a list of organization users:

Sign in to Grafana as an organization administrator.
Hover your cursor over the Configuration (gear) icon in the side menu and click Users.

Note: If you have server administrator permissions, you can also view a global list of users in the Server Admin section of Grafana.

Change a user’s organization permissions

Update user permissions when you want to enhance or restrict a user’s access to organization resources. For more information about organization permissions, refer to Organization roles.

Before you begin

Ensure you have organization administrator privileges

To change the organization role of a user:

Sign in to Grafana as an organization administrator.
Hover your cursor over the Configuration (gear) icon in the side menu and click Users.
Find the user account for which you want to change the role.

If necessary, use the search field to filter the list.
Locate the user on the list and in the Role column, click the user role.
Select the role that you want to assign.
Click Update.

Note: If you have server administrator permissions, you can also change a user’s organization permissions in the Server Admin section.

Invite a user to join an organization

When you invite users to join an organization, you assign the Admin, Editor, or Viewer role which controls user access to the dashboards and data sources owned by the organization. Users receive an email that prompts them to accept the invitation.

If you know that the user already has access Grafana and you know their user name, then you issue an invitation by entering their user name.
If the user is new to Grafana, then use their email address to issue an invitation. The system automatically creates the user account on first sign in.

Note: If you have server administrator permissions, you can also manually add a user to an organization.

Before you begin

Ensure you have organization administrator privileges.
If the user already has access to Grafana, obtain their user name.
Determine the permissions you want to assign to the user. For more information about organization permissions, refer to Organization roles.

To invite or add an existing user account to your organization:

Sign in to Grafana as an organization administrator.
To switch to the organization to which you want to invite a user, hover your mouse over your profile and click Switch organization and select an organization.

Note: It might be that you are currently in the proper organization and don’t need to switch organizations.
Hover your cursor over the Configuration (gear) icon in the side menu and click Users.
Click Invite.

Enter the following information:

Field	Description
Email or username	Either the email or username that the user will use to sign in to Grafana.
Name	The user’s name.
Role	Click the organization role to assign this user. For more information about organization roles, refer to Organization roles..
Send invite email	Switch to on if your organization has configured. The system sends an email to the user inviting them to sign in to Grafana and join the organization. Switch to off if you are not using email. The user can sign in to Grafana with the email or username you entered.

Click Submit.

If the invitee is not already a user, the system adds them.

Manage a pending invitation

Periodically review invitations you have sent so that you can see a list of users that have not yet accepted the invitation or cancel a pending invitation.

Note: The Pending Invites button is only visible if there are unanswered invitations.

Before you begin

Ensure you have organization administrator privileges

To manage a pending invitation:

Sign in to Grafana as an organization administrator.
Hover your cursor over the Configuration (gear) icon in the side menu and click Users.
Click Pending Invites.

The Pending Invites button appears only when there are unaccepted invitations.

To cancel an invitation, click the red X next to the invitation.

To copy an invitation link and send it directly to a user, click Copy Invite. You can then paste the invite link into a message.

Remove a user from an organization

You can remove a user from an organization when they no longer require access to the dashboard or data sources owned by the organization. No longer requiring access to an organization might occur when the user has left your company or has internally moved to another organization.

This action does not remove the user account from the Grafana server.

Before you begin

Ensure you have organization administrator privileges

To remove a user from an organization:

Sign in to Grafana as an organization administrator.
Hover your cursor over the Configuration (gear) icon in the side menu and click Users.
Find the user account that you want to remove from the organization.

Use the search field to filter the list, if necessary.
Click the red X to remove the user from the organization.

Note: If you have server administrator permissions, you can also remove a user from an organization on the Users page of the Server Admin section.

Manage dashboard permissions

Fri, 07 Mar 2025 11:34:44 +0100

Manage dashboard permissions

Dashboard and dasboard folder permissions enable you to grant a viewer the ability to edit and save dashboard changes, or limit an editor’s permission to modify a dashboard.

For more information about dashboard permissions, refer to Dashboard permissions.

Grant dashboard folder permissions

When you grant user permissions for folders, that setting applies to all dashboards contained in the folder. Consider using this approach to assigning dashboard permissions when you have users or teams who require access to groups of related dashboards.

Before you begin

Ensure you have organization administrator privileges
Identify the dashboard folder permissions you want to modify and the users or teams to which you want to grant access. For more information about dashboard permissions, refer to Dashboard permissions.

To grant dashboard folder permissions:

Sign in to Grafana as an organization administrator.
In the sidebar, hover your mouse over the Dashboards (squares) icon and click Browse.
Hover your mouse cursor over a folder and click Go to folder.
Click the Permissions tab, and then click Add Permission.
In the Add Permission For dropdown menu, select User, Team, or one of the role options.
Select the user or team.

If you select a role option, you do not select a user or team.
Select the permission and click Save.

Grant dashboard permissions

When you grant dashboard folder permissions, that setting applies to all dashboards in the folder. For a more granular approach to assigning permissions, you can also assign user permissions to individual dashboards.

For example, if a user with the viewer organization role requires editor (or admin) access to a dashboard, you can assign those elevated permissions on an individual basis.

Note: If you have assigned a user dashboard folder permissions, you cannot also assign the user permission to dashboards contained in the folder.

Grant dashboard permissions when you want to restrict or enhance dashboard access for users who do not have permissions defined in the associated dashboard folder.

Before you begin

Ensure you have organization administrator privileges
Identify the dashboard permissions you want to modify and the users or teams to which you want to grant access

To grant dashboard permissions:

Sign in to Grafana as an organization administrator.
In the sidebar, hover your mouse over the Dashboards (squares) icon and click Browse.
Open a dashboard.
In the top right corner of the dashboard, click Dashboard settings (the cog icon).
Click Permissions and then click Add Permission.
In the Add Permission For dropdown menu, select User or Team.
Select the user or team.
Select the permission and click Save.

Enable viewers to edit (but not save) dashboards and use Explore

By default, the viewer organization role does not allow viewers to create dashboards or use the Explore feature. However, by modifying a configuration setting, you can allow viewers to edit a panel and make changes to a dashboard but not save those changes. This setting also enables viewers to use the Explore feature.

This modification is useful for public Grafana installations where you want anonymous users to be able to edit panels and queries but not save or create new dashboards.

Note: If you use Grafana Enterprise and customize users’ permissions using RBAC, the RBAC permissions override the functionality enabled by the viewers_can_edit flag.

Before you begin

Ensure that you have access to the Grafana server

To enable viewers to preview dashboards and use Explore:

Open the Grafana configuration file.

For more information about the Grafana configuration file and its location, refer to Configuration.
Locate the viewers_can_edit parameter.
Set the viewers_can_edit value to true.
Save your changes and restart Grafana.

Edit dashboard permissions

Edit dashboard permissions when you are want to enhance or restrict a user’s access to a dashboard. For more information about dashboard permissions, refer to Dashboard permissions.

Before you begin

Identify the dashboard and user permission you want to change
Ensure you have organization administrator privileges

To edit dashboard permissions:

Sign in to Grafana as an organization administrator.
In the sidebar, hover your mouse over the Dashboards (squares) icon and click Browse.
Open a dashboard.
In the top-right corner of the dashboard, click Dashboard settings (the cog icon).
Click Permissions.
In the dropdown, update the permissions, and click Save.

Restrict access to dashboards

Grafana applies the highest permission a given user has to access a resource like a dashboard, so if you want to prevent a user from accessing a folder or dashboard you need to consider the user’s organization role, folder permissions, and dashboard permissions.

You cannot override organization administrator permissions. Organization administrators have access to all organization resources.
User permissions set for a dashboard folder propagate to dashboards contained in the folder.
A lower permission level does not affect access if a more general rule exists with a higher permission.

Refer to the following examples to understand how organization and dashboard permissions impact a user’s access to dashboards.

Example 1

In this example, user1 has the editor organization role.

Dashboard permissions settings:

Everyone with Editor role can edit
user1 is set to view

Result: User1 has edit permissions because the user’s organization role is Editor.

Example 2

In this example, user1 has the viewer organization role and is a member of team1.

Dashboard permissions settings:

Everyone with Viewer role can view
user1 is set to edit
team1 is set to admin

Result: User1 has administrator permissions for the dashboard because user1 is a member of team1.

Example 3

In this example, user1 has the viewer organization role.

Dashboard permissions settings:

user1 is set to admin, which is inherited from the permissions set in parent folder
user1 is set to edit

Result: You receive an error message that cannot override a higher permission with a lower permission in the same dashboard. User1 has administrator permissions.

Refer to Role-based access Control in Grafana Enterprise to understand how to use RBAC permissions to restrict access to dashboards, folders, administrative functions, and other resources.