Grafana Folder Permissions
A growing Grafana server collects dashboards from many teams. Without rules, a finance dashboard sits beside an experiment that anyone can edit. Folders, teams, and permissions bring order. They decide who may look, who may change, and who may manage each group of dashboards.
The Office Building Analogy
Imagine an office building with a lobby, department floors, and a server room. Every employee enters the lobby. Marketing staff walk freely around the marketing floor, and only the IT crew holds a key to the server room. Folders act as the floors, teams act as the departments, and permissions act as the keys.
Grafana Server
|
+-----------+-----------+
| | |
[Marketing] [Payments] [Platform] <-- folders
| | |
Team: Mkt Team: Pay Team: Ops <-- teams with access
Organization Roles
Every user holds one role per organization. The role sets the baseline for everything the user does.
| Role | Can Do |
|---|---|
| Viewer | View dashboards and explore data where allowed |
| Editor | Create and edit dashboards and alert rules |
| Admin | Manage users, data sources, teams, and settings |
Folder permissions refine the role for specific folders. A user with the Viewer role can receive edit rights on one folder and nothing more.
Teams
A team is a named group of users. Grant access to the team once, and skip the work of adding ten people one by one. New members join the team and receive the access automatically. People who leave the team lose it just as quickly.
Create a Team
- Open Administration, go to Users and access, and select Teams.
- Click New team and type a name, such as Payments.
- Open the new team and click Add member.
- Search for each user and add them.
Folders
A folder groups dashboards under one name. Create a folder from the Dashboards page with the New button. Move dashboards into it by dragging them or by using the move action. Recent Grafana versions support nested folders, so you can build a tree with Production on top, Payments inside it, and Checkout inside Payments.
Set Folder Permissions
Open a folder, click Folder actions, and choose Manage permissions. Add a permission for a user, a team, or a role.
| Permission | Allows |
|---|---|
| View | Open dashboards in the folder |
| Edit | Change dashboards and add new ones |
| Admin | Change dashboards and manage the folder permissions |
A Sample Setup
| Folder | Who | Permission |
|---|---|---|
| Payments | Team Payments | Edit |
| Payments | Team Support | View |
| Payments | Role Viewer | Removed |
| Platform | Team Ops | Admin |
Payments engineers edit their own dashboards. Support staff read them. People outside both teams see nothing in the folder, because the team removed the broad Viewer permission.
Inheritance
Dashboards inherit the permissions of their folder. A dashboard in the Payments folder follows the Payments rules without extra work. Nested folders inherit from the parent folder as well.
Production Team Ops: Edit
|
+-- Payments inherits Ops: Edit
| | plus Team Payments: Edit
| +-- Checkout inherits both
|
+-- Search inherits Ops: Edit
A lower level adds permissions on top of the inherited ones. Plan the tree so that broad access sits near the top and narrow access sits near the bottom.
Dashboard Level Permissions
Individual dashboards accept their own permissions too. Use this feature sparingly, because many one-off exceptions create confusion. A rule works best when you can describe it in a single sentence: "Payments engineers edit the Payments folder."
Permissions for Other Items
Data sources and alert rules respect permissions as well. A data source that holds sensitive data can limit queries to selected teams. Alert rules live in folders, so folder permissions control who edits them.
Good Practices
- Grant access to teams, not individuals.
- Follow the least privilege rule: give the smallest permission that lets someone finish the job.
- Name folders after teams or services.
- Review the permissions of sensitive folders every quarter.
- Keep the number of Admin users small.
Troubleshooting
A User Cannot See a Dashboard
Check the folder permissions and the teams of that user. A missing team membership explains most cases.
A User Can Edit More Than Expected
Inspect the organization role. An Editor role grants broad rights that a folder permission cannot reduce.