You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/managed-grafana/how-to-sync-teams-with-aad-groups.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.date: 9/11/2023
10
10
11
11
# Sync Grafana teams with Azure Active Directory groups (preview)
12
12
13
-
In this guide, you learn how to use Azure ActiveDirectory (Azure AD) groups with [Grafana Team Sync](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/) (Azure AD group sync) to set dashboard permissions in Azure Managed Grafana. Grafana allows you to control access to its resources at multiple levels. In Managed Grafana, you use the built-in Azure RBAC roles for Grafana to define access rights users have. These permissions are applied to all resources in your Grafana workspace by default. You can't, for example, grant someone edit permission to only one particular dashboard with RBAC. If you assign a user to the Grafana Editor role, that user can make changes to any dashboard in your Grafana workspace. Using Grafana's [granular permission model](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/), you can elevate or demote a user's default permission level for specific dashboards (or dashboard folders).
13
+
In this guide, you learn how to use Azure Active Directory (Azure AD) groups with [Grafana Team Sync](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/) (Azure AD group sync) to set dashboard permissions in Azure Managed Grafana. Grafana allows you to control access to its resources at multiple levels. In Managed Grafana, you use the built-in Azure RBAC roles for Grafana to define access rights users have. These permissions are applied to all resources in your Grafana workspace by default. You can't, for example, grant someone edit permission to only one particular dashboard with RBAC. If you assign a user to the Grafana Editor role, that user can make changes to any dashboard in your Grafana workspace. Using Grafana's [granular permission model](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/), you can elevate or demote a user's default permission level for specific dashboards (or dashboard folders).
14
14
15
15
Setting up dashboard permissions for individual users in Managed Grafana is a little tricky. Managed Grafana stores the user assignments for its built-in RBAC roles in Azure AD. For performance reasons, it doesn't automatically synchronizes the user assignments to Grafana workspaces. Users in these roles don't show up in Grafana's **Configuration** UI until they've signed in once. You can only grant users extra permissions after they appear in the Grafana user list in **Configuration**. Azure AD group sync gets around this issue. With this feature, you create a *Grafana team* in your Grafana workspace linked with an Azure AD group. You then use that team in configuring your dashboard permissions. For example, you can grant a viewer the ability to modify a dashboard or block an editor from being able to make changes. You don't need to manage the team's member list separately since its membership is already defined in the associated Azure AD group.
16
16
@@ -24,20 +24,20 @@ To use Azure AD group sync, you add a new team to your Grafana workspace and lin
24
24
1. In the Azure portal, open Azure Active Directory.
25
25
1. Select **Groups** and find the Azure AD group you plan to use.
26
26
1. Select the group name in the search result.
27
-
1. Copy the value in the *Object Id* field. You need to provide this information later.
27
+
1. Copy the value in the *Object ID* field. You need to provide this information later.
28
28
29
-
:::image type="content" source="media/aad-group-sync/find-aad-group-object-id.png" alt-text="Screenshot of the Azure Active Directory. Finding group object ID.":::
29
+
:::image type="content" source="media/azure-ad-group-sync/find-azure-ad-group-object-id.png" alt-text="Screenshot of the Azure Active Directory. Finding Azure AD group's object ID.":::
30
30
31
31
1. Open your Azure Managed Grafana workspace.
32
32
1. Select **Administration > Teams**.
33
33
1. Select **New Team**, enter a name for the team, and select **Create**.
34
34
35
-
:::image type="content" source="media/aad-group-sync/create-new-grafana-team.png" alt-text="Screenshot of the Grafana platform. Creating a new Grafana team.":::
35
+
:::image type="content" source="media/azure-ad-group-sync/create-new-grafana-team.png" alt-text="Screenshot of the Grafana platform. Creating a new Grafana team.":::
36
36
37
37
1. Select the **External group sync** tab, and **Add group**.
38
38
1. Enter the Azure AD group object ID obtained before, and select **Add group** to link to that group.
39
39
40
-
:::image type="content" source="media/aad-group-sync/link-aad-group.png" alt-text="Screenshot of the Grafana platform. Configuring Grafana team to sync with Azure AD group.":::
40
+
:::image type="content" source="media/azure-ad-group-sync/link-azure-ad-group.png" alt-text="Screenshot of the Grafana platform. Configuring Grafana team to sync with Azure AD group.":::
41
41
42
42
## Remove Azure AD group sync
43
43
@@ -47,7 +47,7 @@ If you no longer need a Grafana team, follow these steps to delete it, which als
47
47
1. Select **Administration > Teams**.
48
48
1. Select the **X** button to the right of a team you're deleting.
49
49
50
-
:::image type="content" source="media/aad-group-sync/remove-aad-group-sync.png" alt-text="Screenshot of the Grafana platform. Removing a Grafana team.":::
50
+
:::image type="content" source="media/azure-ad-group-sync/remove-azure-ad-group-sync.png" alt-text="Screenshot of the Grafana platform. Removing a Grafana team.":::
0 commit comments