Grafana Role-based access control (RBAC) on Grafana Labs

Plan your Grafana RBAC rollout strategy

Fri, 03 Apr 2026 19:43:06 +0000

Plan your RBAC rollout strategy

Note
Available in Grafana Enterprise and Grafana Cloud.

An RBAC rollout strategy helps you determine how you want to implement RBAC prior to assigning RBAC roles to users and teams.

Your rollout strategy should help you answer the following questions:

Should I assign basic roles to users, or should I assign fixed roles or custom roles to users?
When should I create custom roles?
To which entities should I apply fixed and custom roles? Should I apply them to users, teams? Should I modify the basic roles permissions instead?
How do I roll out permissions in a way that makes them easy to manage?
Which approach should I use when assigning roles? Should I use the Grafana UI, provisioning, or the API?

Review basic role and fixed role definitions

As a first step in determining your permissions rollout strategy, we recommend that you become familiar with basic role and fixed role definitions. In addition to assigning fixed roles to any user and team, you can also modify basic roles permissions, which changes what a Viewer, Editor, or Admin can do. This flexibility means that there are many combinations of role assignments for you to consider. If you have a large number of Grafana users and teams, we recommend that you make a list of which fixed roles you might want to use. Keep in mind that No Basic Role, which is a role without permissions, cannot be modified or updated.

To learn more about basic roles and fixed roles, refer to the following documentation:

User and team considerations

RBAC is a flexible and powerful feature with many possible permissions assignment combinations available. Consider the follow guidelines when assigning permissions to users and teams.

Assign roles to users when you have a one-off scenario where a small number of users require access to a resource or when you want to assign temporary access. If you have a large number of users, this approach can be difficult to manage as you scale your use of Grafana. For example, a member of your IT department might need the fixed:licensing:reader and fixed:licensing:writer roles so that they can manage your Grafana Enterprise license.
Assign roles to teams when you have a subset of users that align to your organizational structure, and you want all members of the team to have the same level of access. For example, all members of a particular engineering team might need the fixed:reports:reader and fixed:reports:writer roles to be able to manage reports.

When you assign additional users to a team, the system automatically assigns permissions to those users.

Authentication provider considerations

You can take advantage of your current authentication provider to manage user and team permissions in Grafana. When you map users and teams to SAML and LDAP groups, you can synchronize those assignments with Grafana.

For example:

Map SAML, LDAP, or Oauth roles to Grafana basic roles (viewer, editor, or admin).
Use the Grafana Enterprise team sync feature to synchronize teams from your SAML, LDAP, or OAuth provider to Grafana. For more information about team sync, refer to Team sync.
Within Grafana, assign RBAC permissions to users and teams.

When to modify basic roles or create custom roles

Consider the following guidelines when you determine if you should modify basic roles or create custom roles.

Modify basic roles when Grafana’s definitions of what viewers, editors, and admins can do does not match your definition of these roles. You can add or remove permissions from any basic role.

Note
Changes that you make to basic roles impact the role definition for all organizations in the Grafana instance. For example, when you add the fixed:users:writer role’s permissions to the viewer basic role, all viewers in any org in the Grafana instance can create users within that org.

Note
You cannot modify the No Basic Role permissions.
Create custom roles when fixed role definitions don’t meet you permissions requirements. For example, the fixed:dashboards:writer role allows users to delete dashboards. If you want some users or teams to be able to create and update but not delete dashboards, you can create a custom role with a name like custom:dashboards:creator that lacks the dashboards:delete permission.

How to assign RBAC roles

Use any of the following methods to assign RBAC roles to users and teams.

Grafana UI: Use the Grafana UI when you want to assign a limited number of RBAC roles to users and teams. The UI contains a role picker that you can use to select roles.
Grafana HTTP API: Use the Grafana HTTP API if you would like to automate role assignment.
Terraform: Use Terraform to assign and manage user and team role assignments if you use Terraform for provisioning.
Grafana provisioning: Grafana provisioning provides a robust approach to assigning, removing, and deleting roles. Within a single YAML file you can include multiple role assignment and removal entries.

Permissions scenarios

We’ve compiled the following permissions rollout scenarios based on current Grafana implementations.

Note
If you have a use case that you’d like to share, feel free to contribute to this docs page. We’d love to hear from you!

Provide internal viewer employees with the ability to use Explore, but prevent external viewer contractors from using Explore

In Grafana, create a team with the name Internal employees.
Assign the fixed:datasources:explorer role to the Internal employees team.
Add internal employees to the Internal employees team, or map them from a SAML, LDAP, or OAuth team using Team Sync.
Assign the viewer role to both internal employees and contractors.

Limit viewer, editor, or admin permissions

Review the list of permissions associated with the basic role.
Change the permissions of the basic role.

Allow only members of one team to manage Alerts

Create an Alert Managers team, and assign that team all applicable Alerting fixed roles.
Add users to the Alert Managers team.
Remove all permissions with actions prefixed with alert. from the Viewer, Editor, and Admin basic roles.

Provide dashboards to users in two or more geographies

Create a folder for each geography, for example, create a US folder and an EU folder.
Add dashboards to each folder.
Use folder permissions to add US-based users as Editors to the US folder and assign EU-based users as Editors to the EU folder.

Assign a user specific set of roles

Create a user with the No Basic Role selected under organization roles.
Assign the user a set of fixed roles that meet your requirements.

Create a custom role to access alerts in a specific folder

To see an alert rule in Grafana, the user must have read access to the folder that stores the alert rule, permission to read alerts in the folder, and permission to query all data sources that the rule uses.

The API command in this example is based on the following:

A Test-Folder with ID 92
Two data sources: DS1 with UID _oAfGYUnk, and DS2 with UID YYcBGYUnk
An alert rule that is stored in Test-Folder and queries the two data sources.

The following request creates a custom role that includes permissions to access the alert rule:

curl --location --request POST '<grafana_url>/api/access-control/roles/' \
--header 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
--header 'Content-Type: application/json' \
--data-raw '{
    "version": 1,
    "name": "custom:alerts.reader.in.folder.123",
    "displayName": "Read-only access to alerts in folder Test-Folder",
    "description": "Let user query DS1 and DS2, and read alerts in folder Test-Folders",
    "group":"Custom",
    "global": false,
    "permissions": [
        {
            "action": "folders:read",
            "scope": "folders:uid:YEcBGYU22"
        },
        {
            "action": "alert.rules:read",
            "scope": "folders:uid:YEcBGYU22"
        },
        {
            "action": "datasources:query",
            "scope": "datasources:uid:_oAfGYUnk"
        },
        {
            "action": "datasources:query",
            "scope": "datasources:uid:YYcBGYUnk"
        }
    ]
}'

Enable an editor to create custom roles

By default, only a Grafana Server Admin can create and manage custom roles. If you want your Editors to do the same, update the Editor basic role permissions. There are two ways to achieve this:

Add the following permissions to the basic:editor role, using provisioning or the RBAC HTTP API:

action	scope
`roles:read`	`roles:*`
`roles:write`	`permissions:type:delegate`
`roles:delete`	`permissions:type:delegate`

As an example, here is a small bash script that fetches the role, modifies it using jq and updates it:

# Fetch the role, modify it to add the desired permissions and increment its version
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
  -X GET '<grafana_url>/api/access-control/roles/basic_editor' | \
  jq 'del(.created)| del(.updated) | del(.permissions[].created) | del(.permissions[].updated) | .version += 1' | \
  jq '.permissions += [{"action": "roles:read", "scope": "roles:*"}, {"action": "roles:write", "scope": "permissions:type:delegate"}, {"action": "roles:delete", "scope": "permissions:type:delegate"}]' > /tmp/basic_editor.json

# Update the role
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' -H 'Content-Type: application/json' \
  -X PUT-d @/tmp/basic_editor.json '<grafana_url>/api/access-control/roles/basic_editor'

Or add the fixed:roles:writer role permissions to the basic:editor role using the role > from list of your provisioning file:

apiVersion: 2

roles:
  - name: 'basic:editor'
    global: true
    version: 3
    from:
      - name: 'basic:editor'
        global: true
      - name: 'fixed:roles:writer'
        global: true

Note: Any user or service account with the ability to modify roles can only create, update, or delete roles with permissions they have been granted. For example, a user with the Editor role would be able to create and manage roles only with the permissions they have or with a subset of them.

Enable viewers to create reports

If you want your Viewers to create reports, update the Viewer basic role permissions. There are two ways to achieve this:

Add the following permissions to the basic:viewer role, using provisioning or the RBAC HTTP API:

Action	Scope
`reports:create`	n/a
`reports:write`	`reports:` `reports:id:`
`reports:read`	`reports:*`
`reports:send`	`reports:*`

As an example, here is a small bash script that fetches the role, modifies it using jq and updates it:

# Fetch the role, modify it to add the desired permissions and increment its version
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
  -X GET '<grafana_url>/api/access-control/roles/basic_viewer' | \
  jq 'del(.created)| del(.updated) | del(.permissions[].created) | del(.permissions[].updated) | .version += 1' | \
  jq '.permissions += [{"action": "reports:create"}, {"action": "reports:read", "scope": "reports:*"}, {"action": "reports:write", "scope": "reports:*"}, {"action": "reports:send", "scope": "reports:*"}]' > /tmp/basic_viewer.json

# Update the role
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' -H 'Content-Type: application/json' \
  -X PUT-d @/tmp/basic_viewer.json '<grafana_url>/api/access-control/roles/basic_viewer'

Or add the fixed:reports:writer role permissions to the basic:viewer role using the role > from list of your provisioning file:

apiVersion: 2

roles:
  - name: 'basic:viewer'
    global: true
    version: 3
    from:
      - name: 'basic:viewer'
        global: true
      - name: 'fixed:reports:writer'
        global: true

Note: The fixed:reports:writer role assigns more permissions than just creating reports. For more information about fixed role permission assignments, refer to Fixed role definitions.

Prevent a Grafana Admin from creating and inviting users

To prevent a Grafana Admin from creating users and inviting them to join an organization, you must update a basic role permission. The permissions to remove are:

Action	Scope
`users:create`
`org.users:add`	`users:*`

There are two ways to achieve this:

Use RBAC HTTP API.

As an example, here is a small bash script that fetches the role, modifies it using jq and updates it:

# Fetch the role, modify it to remove the undesired permissions and increment its version
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
  -X GET '<grafana_url>/api/access-control/roles/basic_grafana_admin' | \
  jq 'del(.created)| del(.updated) | del(.permissions[].created) | del(.permissions[].updated) | .version += 1' | \
  jq 'del(.permissions[] | select (.action == "users:create")) | del(.permissions[] | select (.action == "org.users:add" and .scope == "users:*"))' > /tmp/basic_grafana_admin.json

# Update the role
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' -H 'Content-Type: application/json' \
  -X PUT-d @/tmp/basic_grafana_admin.json '<grafana_url>/api/access-control/roles/basic_grafana_admin'

Or use the role > from list and permission > state option of your provisioning file:

apiVersion: 2

roles:
  - name: 'basic:grafana_admin'
    global: true
    version: 3
    from:
      - name: 'basic:grafana_admin'
        global: true
    permissions:
      - action: 'users:create'
        state: 'absent'
      - action: 'org.users:add'
        scope: 'users:*'
        state: 'absent'

Prevent Viewers from accessing an App Plugin

By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access. To change this default behavior and prevent Viewers from accessing an App plugin, you must update a basic role’s permissions.

In this example, three App plugins have been installed and enabled:

Name	ID	Required Org role
On Call	grafana-oncall-app	Viewer
Kentik Connect Pro	kentik-connect-app	Viewer
Enterprise logs	grafana-enterprise-logs-app	Admin

By default, Viewers will hence be able to see both, On Call and Kentik Connect Pro App plugins. If you want to revoke their access to the On Call App plugin, you need to:

Remove the permission to access all application plugins:

Action Scope

plugins.app:access plugins:*
Grant the permission to access the Kentik Connect Pro App plugin only:

Action Scope

plugins.app:access plugins:id:kentik-connect-app

Action	Scope
`plugins.app:access`	`plugins:*`

Action	Scope
`plugins.app:access`	`plugins:id:kentik-connect-app`

Here are two ways to achieve this:

Use RBAC HTTP API.

As an example, here is a small bash script that fetches the role, modifies it using jq and updates it:

# Fetch the role, modify it to remove the undesired permissions, add the new permission and increment its version
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
  -X GET '<grafana_url>/api/access-control/roles/basic_viewer' | \
  jq 'del(.created)| del(.updated) | del(.permissions[].created) | del(.permissions[].updated) | .version += 1' | \
  jq 'del(.permissions[] | select (.action == "plugins.app:access" and .scope == "plugins:*"))' | \
  jq '.permissions += [{"action": "plugins.app:access", "scope": "plugins:id:kentik-connect-app"}]' > /tmp/basic_viewer.json

# Update the role
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' -H 'Content-Type: application/json' \
  -X PUT -d @/tmp/basic_viewer.json '<grafana_url>/api/access-control/roles/basic_viewer'

The token that is used in this request is the service account token.

Or use the role > from list and permission > state option of your provisioning file:

---
apiVersion: 2

roles:
  - name: 'basic:viewer'
    version: 8
    global: true
    from:
      - name: 'basic:viewer'
        global: true
    permissions:
      - action: 'plugins.app:access'
        scope: 'plugins:*'
        state: 'absent'
      - action: 'plugins.app:access'
        scope: 'plugins:id:kentik-connect-app'
        state: 'present'

If your goal is to remove an access to an app you should remove it from the role and update it. For example:

# Fetch the role, modify it to remove permissions to kentik-connect-app and increment role version
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' \
  -X GET '<grafana_url>/api/access-control/roles/basic_viewer' | \
  jq 'del(.created)| del(.updated) | del(.permissions[].created) | del(.permissions[].updated) | .version += 1' | \
  jq 'del(.permissions[] | select (.action == "plugins.app:access" and .scope == "plugins:id:kentik-connect-app"))'

# Update the role
curl -H 'Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697' -H 'Content-Type: application/json' \
  -X PUT -d @/tmp/basic_viewer.json '<grafana_url>/api/access-control/roles/basic_viewer'

Manage user permissions through teams

In the scenario where you want users to grant access by the team they belong to, we recommend to set users role to No Basic Role and let the team assignment assign the role instead.

In Grafana, ensure the following configuration settings are enabled.

[users]
# Set to true to automatically assign new users to the default organization (id 1)
auto_assign_org = true

# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
auto_assign_org_id = <org_id>

# Default role new users will be automatically assigned (if auto_assign_org above is set to true)
auto_assign_org_role = None

Restart the Grafana instance.
Create a team with the desired name.
Assign fixed roles to the team.
Add users to the team.

A user will be added to the default organization automatically but won’t have any permissions until assigned to a team.

Reduce scope of service accounts

Using Service Accounts is an efficient way to facilitate M2M communications. However, they can pose a security threat if not scoped appropriately. To limit the scope of a service account, you can begin by creating a Service Account with No Basic Role and then assign the necessary permissions for the account.

Refer to Service Accounts and add a new Service Account.
Set the basic role to No Basic Role.
Set the fixed roles needed for the Service Account.

This will reduce the required permissions for the Service Account and minimize the risk of compromise.

Configure RBAC in Grafana

Fri, 03 Apr 2026 19:43:06 +0000

Configure RBAC in Grafana

Note
Available in Grafana Enterprise and Grafana Cloud.

The table below describes all RBAC configuration options. Like any other Grafana configuration, you can apply these options as environment variables.

Setting	Required	Description	Default
`permission_cache`	No	Enable to use in memory cache for loading and evaluating users’ permissions.	`true`
`permission_validation_enabled`	No	Grafana enforces validation for permissions when a user creates or updates a role. The system checks the internal list of scopes and actions for each permission to determine they are valid. By default, if a scope or action is not recognized, Grafana logs a warning message. When set to `true`, Grafana returns an error.	`true`
`reset_basic_roles`	No	Reset Grafana’s basic roles’ (Viewer, Editor, Admin, Grafana Admin) permissions to their default. Warning, if this configuration option is left to `true` this will be done on every reboot.	`true`

Example RBAC configuration

[rbac]

permission_cache = true

Assign Grafana RBAC roles

Fri, 03 Apr 2026 19:43:06 +0000

Assign RBAC roles

Note
Available in Grafana Enterprise and Grafana Cloud.

In this topic you’ll learn how to use the role picker, provisioning, and the HTTP API to assign fixed and custom roles to users and teams.

Assign fixed roles in the UI using the role picker

This section describes how to:

Assign a fixed role to a user, team or service account as an organization administrator.
Assign a fixed role to a user as a server administrator. This approach enables you to assign a fixed role to a user in multiple organizations, without needing to switch organizations.

In both cases, the assignment applies only to the user, team or service account within the affected organization, and no other organizations. For example, if you grant the user the Data source editor role in the Main organization, then the user can edit data sources in the Main organization, but not in other organizations.

Before you begin:

Plan your RBAC rollout strategy.
Identify the fixed roles that you want to assign to the user, team or service account.

For more information about available fixed roles, refer to RBAC role definitions.
Ensure that your own user account has the correct permissions:
- If you are assigning permissions to a user, team or service account within an organization, you must have organization administrator or server administrator permissions.
- If you are assigning permissions to a user who belongs to multiple organizations, you must have server administrator permissions.
- Your Grafana user can also assign fixed role if it has either the fixed:roles:writer fixed role assigned to the same organization to which you are assigning RBAC to a user, or a custom role with users.roles:add and users.roles:remove permissions.
- Your own user account must have the roles you are granting. For example, if you would like to grant the fixed:users:writer role to a team, you must have that role yourself.

To assign a fixed role to a user, team or service account:

Sign in to Grafana.
Switch to the organization that contains the user, team or service account.

For more information about switching organizations, refer to Switch organizations.
In the left-side menu, click Administration, Users and access, and then Users, Teams, or Service accounts.
In the Role column, select the fixed role that you want to assign to the user, team, or service account.
Click Update.

To assign a fixed role as a server administrator:

Sign in to Grafana as a server administrator.
Click Administration in the left-side menu, Users and access, and then Users.
Click a user.
In the Organizations section, click Change role.
Select a role within an organization that you want to assign to the user.
Click Save.

Assign fixed or custom roles using the HTTP API

This section describes how to:

Assign a fixed role to a user, team or service account as an organization administrator.

Before you begin:

Plan your RBAC rollout strategy.
Identify the fixed roles that you want to assign to the user, team or service account.

For more information about available fixed roles, refer to RBAC role definitions.
Ensure that your own user account has the correct permissions:
- If you are assigning permissions to a user, team or service account within an organization, you must have organization administrator or server administrator permissions.
- If you are assigning permissions to a user who belongs to multiple organizations, you must have server administrator permissions.
- Your Grafana user can also assign fixed role if it has either the fixed:roles:writer fixed role assigned to the same organization to which you are assigning RBAC to a user, or a custom role with users.roles:add and users.roles:remove permissions.
- Your own user account must have the roles you are granting. For example, if you would like to grant the fixed:users:writer role to a team, you must have that role yourself.

To assign a fixed role to a user or service account:

Refer to the RBAC HTTP API for user role assignment.

The service account ID can be used in place of the user ID.

To assign a fixed role to a team:

Refer to the RBAC HTTP API for team role assignment.

Assign fixed or custom roles to a team using provisioning

Instead of using the Grafana role picker, you can use file-based provisioning to assign fixed roles to teams. If you have a large number of teams, provisioning can provide an easier approach to assigning and managing role assignments.

Before you begin:

Refer to Role provisioning
Ensure that the team to which you are adding the fixed role exists. For more information about creating teams, refer to Manage teams

To assign a role to a team:

Open the YAML configuration file.

Refer to the following table to add attributes and values.

Attribute	Description
`roles`	Enter the custom role or custom roles you want to create/update.
`roles > name`	Enter the name of the custom role.
`roles > version`	Enter the custom role version number. Role assignments are independent of the role version number.
`roles > global`	Enter `true`. You can specify the `orgId` otherwise.
`roles > permissions`	Enter the permissions `action` and `scope` values. For more information about permissions actions and scopes, refer to RBAC permissions, actions, and scopes
`teams`	Enter the team or teams to which you are adding the custom role.
`teams > orgId`	Because teams belong to organizations, you must add the `orgId` value.
`teams > name`	Enter the name of the team.
`teams > roles`	Enter the custom or fixed role or roles that you want to grant to the team.
`teams > roles > name`	Enter the name of the role.
`teams > roles > global`	Enter `true`, or specify `orgId` of the role you want to assign to the team. Fixed roles are global.

For more information about managing custom roles, refer to Create custom roles using provisioning.

Reload the provisioning configuration file.

For more information about reloading the provisioning configuration at runtime, refer to Reload provisioning configurations.

The following example creates the custom:users:writer role and assigns it to the user writers and user admins teams along with the fixed:users:writer role:

The following example:

Creates the custom:users:writer role.
Assigns the custom:users:writer role and the fixed:users:writer role to the user admins and user writers teams.

# config file version
apiVersion: 2

# Roles to insert/update in the database
roles:
  - name: 'custom:users:writer'
    description: 'List/update other users in the organization'
    version: 1
    global: true
    permissions:
      - action: 'org.users:read'
        scope: 'users:*'
      - action: 'org.users:write'
        scope: 'users:*'

# Assignments to teams
teams:
  - name: 'user writers'
    orgId: 1
    roles:
      # Custom role assignment
      - name: 'custom:users:writer'
        global: true
      # Fixed role assignment
      - name: 'fixed:users:writer'
        global: true
  - name: 'user admins'
    orgId: 1
    roles:
      - name: 'custom:users:writer'
        global: true
      - name: 'fixed:users:writer'
        global: true

Note: The roles don’t have to be defined in the provisioning configuration files to be assigned. If roles exist in the database, they can be assigned.

Remove a role assignment from a team:

If you want to remove an assignment from a team, add state: absent to the teams > roles section, and reload the configuration file.

The following example:

Creates the custom:users:writer role
Assigns the custom:users:writer role and the fixed:users:writer role to the user admins team
Removes the custom:users:writer and the fixed:users:writer assignments from the user writers team, if those assignments exist.

# config file version
apiVersion: 2

# Roles to insert/update in the database
roles:
  - name: 'custom:users:writer'
    description: 'List/update other users in the organization'
    version: 1
    global: true
    permissions:
      - action: 'org.users:read'
        scope: 'users:*'
      - action: 'org.users:write'
        scope: 'users:*'

# Assignments to teams
teams:
  - name: 'user writers'
    orgId: 1
    roles:
      - name: 'fixed:users:writer'
        global: true
        state: 'absent' # Remove assignment
      - name: 'custom:users:writer'
        global: true
        state: 'absent' # Remove assignment
  - name: 'user admins'
    orgId: 1
    roles:
      - name: 'fixed:users:writer'
        global: true
      - name: 'custom:users:writer'
        global: true

Note: The roles don’t have to be defined in the provisioning configuration files to be revoked. If roles exist in the database, they can be revoked.

Manage Grafana RBAC roles

Fri, 03 Apr 2026 19:43:06 +0000

Manage RBAC roles

Note
Available in Grafana Enterprise and Grafana Cloud.

This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles.

View basic role definitions

You can retrieve the full definition of a basic role, including all associated permissions, using the API or by navigating directly to the endpoint URL in your browser while logged in as an Admin.

Using the API

To get the definition of a basic role:

GET /api/access-control/roles/basic_<role>

Where <role> is one of: viewer, editor, admin, or grafana_admin.

For example, to get the Viewer role definition:

curl --location 'https://<your-stack-name>.grafana.net/api/access-control/roles/basic_viewer' \
  --header 'Authorization: Bearer <service-account-token>'

Using the browser

You can also view the role definition directly in your browser by navigating to:

https://<your-stack-name>.grafana.net/api/access-control/roles/basic_viewer

This works when logged in as an Admin user.

For more information, refer to Get a role.

For a reference of basic and fixed role assignments, refer to RBAC role definitions.

Update role permissions

If the default basic role permissions don’t meet your requirements you can change them.

You can change basic roles’ permissions via the configuration file or using the RBAC API.

Update basic role permissions in the configuration file

Before you begin, determine the permissions you want to add or remove from a basic role. For more information about the permissions associated with basic roles, refer to RBAC role definitions.

Note
You cannot modify the No Basic Role permissions.

To change permissions from a basic role:

Open the YAML configuration file and locate the roles section.

Refer to the following table to add attributes and values.

Attribute	Description
`name`	The name of the basic role you want to update. You can specify a `uid` instead of a role name. The role `name` or the `uid` are required.
`orgId`	Identifies the organization to which the role belongs. `global` can be used instead to specify it’s a global role.
`version`	Identifies the version of the role, which prevents overwriting newer changes.
`overrideRole`	If set to true, role will be updated regardless of its version in the database. There is no need to specify `version` if `overrideRole` is set to `true`.
`from`	List of roles from which to copy permissions.
`permissions > state`	The state of the permission. You can set it to `absent` to ensure it exclusion from the copy list.

Reload the provisioning configuration file.

For more information about reloading the provisioning configuration at runtime, refer to Reload provisioning configurations.

The following example modifies the Grafana Admin basic role permissions.

Permissions to list, grant, and revoke roles to teams are removed.
Permission to read and write Grafana folders is added.

# config file version
apiVersion: 2

roles:
  - name: 'basic:grafana_admin'
    global: true
    version: 3
    from:
      - name: 'basic:grafana_admin'
        global: true
    permissions:
      # Permissions to remove
      - action: 'teams.roles:read'
        scope: 'teams:*'
        state: 'absent'
      - action: 'teams.roles:remove'
        scope: 'permissions:type:delegate'
        state: 'absent'
      - action: 'teams.roles:add'
        scope: 'permissions:type:delegate'
        state: 'absent'
      # Permissions to add
      - action: 'folders:read'
        scope: 'folder:*'
      - action: 'folders:write'
        scope: 'folder:*'

Note
You can add multiple fixed, basic or custom roles to the from section. Their permissions will be copied and added to the basic role. Make sure to increment the role version for the changes to be accounted for.

You can also change basic roles’ permissions using the API. Refer to the RBAC HTTP API for more details.

Update basic role permissions using the RBAC API

Refer to the RBAC HTTP API for more details.

Reset basic roles to their default

This section describes how to reset the basic roles to their default.

You have two options to reset the basic roles permissions to their default.

Use the configuration option

Note: Available as of Grafana Enterprise 9.4.

Warning: If this option is left to true, permissions will be reset on every boot.

Use the reset_basic_roles option to reset basic roles permissions to their default on Grafana instance boot up.

Open you configuration file and update the rbac section as follow:

[rbac]
reset_basic_roles = true

Use the http endpoint

An alternative to the configuration option is to use the HTTP endpoint.

Open the YAML configuration file and locate the roles section.

Grant the action: "roles:write", scope: "permissions:type:escalate permission to Grafana Admin. Note that this permission has not been granted to any basic roles by default, because users could acquire more permissions than they previously had through the basic role permissions reset.

apiVersion: 2
roles:
  - name: 'basic:grafana_admin'
    global: true
    version: 3
    from:
      - name: 'basic:grafana_admin'
        global: true
    permissions:
      # Permission allowing to reset basic roles
      - action: 'roles:write'
        scope: 'permissions:type:escalate'

As a Grafana Admin, call the API endpoint to reset the basic roles to their default. Refer to the RBAC HTTP API for more details.

Delete a custom role using Grafana provisioning

Delete a custom role when you no longer need it. When you delete a custom role, the custom role is removed from users and teams to which it is assigned.

Before you begin:

Identify the role or roles that you want to delete.
Ensure that you have access to the YAML configuration file.

To delete a custom role:

Open the YAML configuration file and locate the roles section.

Refer to the following table to add attributes and values.

Attribute	Description
`name`	The name of the custom role you want to delete. You can specify a `uid` instead of a role name. The role `name` or the `uid` are required.
`orgId`	Identifies the organization to which the role belongs.
`state`	The state of the role set to `absent` to trigger its removal.
`force`	When set to `true`, the roles are removed even if there are existing assignments.

Reload the provisioning configuration file.

For more information about reloading the provisioning configuration at runtime, refer to Reload provisioning configurations.

The following example deletes a custom role:

# config file version
apiVersion: 2

roles:
  - name: 'custom:reports:editor'
    orgId: 1
    state: 'absent'
    force: true

You can also delete a custom role using the API. Refer to the RBAC HTTP API for more details.

Provisioning RBAC with Grafana

Fri, 03 Apr 2026 19:43:06 +0000

Provisioning RBAC with Grafana

Note
Available in Grafana Enterprise for self-managed instances. This feature is not available in Grafana Cloud.

You can create, change or remove Custom roles and create or remove basic role assignments, by adding one or more YAML configuration files in the provisioning/access-control/ directory.

Because this method requires access to the file system where Grafana is running, it’s only available for self-managed Grafana instances. To provision RBAC in Grafana Cloud, use Terraform or the HTTP API.

Grafana performs provisioning during startup. After you make a change to the configuration file, you can reload it during runtime. You do not need to restart the Grafana server for your changes to take effect.

Before you begin:

Ensure that you have access to files on the server where Grafana is running.

To manage and assign RBAC roles using provisioning:

Sign in to the Grafana server.
Locate the Grafana provisioning folder.
Create a new YAML in the following folder: provisioning/access-control. For example, provisioning/access-control/custom-roles.yml
Add RBAC provisioning details to the configuration file.

Refer to Manage RBAC roles and Assign RBAC roles for instructions.

Refer to example role provisioning file for a complete example of a provisioning file.
Reload the provisioning configuration file.

For more information about reloading the provisioning configuration at runtime, refer to Reload provisioning configurations.

Example role configuration file using Grafana provisioning

The following example shows a complete YAML configuration file that:

Create custom roles
Delete custom roles
Update basic roles permissions
Assign roles to teams
Revoke assignments of roles to teams

Example

---
# config file version
apiVersion: 2

# <list> list of roles to insert/update/delete
roles:
  # <string, required> name of the role you want to create or update. Required.
  - name: 'custom:users:writer'
    # <string> uid of the role. Has to be unique for all orgs.
    uid: customuserswriter1
    # <string> description of the role, informative purpose only.
    description: 'Create, read, write users'
    # <int> version of the role, Grafana will update the role when increased.
    version: 2
    # <int> org id. Defaults to Grafana's default if not specified.
    orgId: 1
    # <list> list of the permissions granted by this role.
    permissions:
      # <string, required> action allowed.
      - action: 'users:read'
        #<string> scope it applies to.
        scope: 'users:*'
      - action: 'users:write'
        scope: 'users:*'
      - action: 'users:create'
  - name: 'custom:global:users:reader'
    # <bool> overwrite org id and creates a global role.
    global: true
    # <string> state of the role. Defaults to 'present'. If 'absent', role will be deleted.
    state: 'absent'
    # <bool> force deletion revoking all grants of the role.
    force: true
  - uid: 'basic_editor'
    # <bool> always apply the specified changes to the role, regardless of the role version in the database
    overrideRole: true
    global: true
    # <list> list of roles to copy permissions from.
    from:
      - uid: 'basic_editor'
        global: true
      - name: 'fixed:users:writer'
        global: true
    # <list> list of the permissions to add/remove on top of the copied ones.
    permissions:
      - action: 'users:read'
        scope: 'users:*'
      - action: 'users:write'
        scope: 'users:*'
        # <string> state of the permission. Defaults to 'present'. If 'absent', the permission will be removed.
        state: absent

# <list> list role assignments to teams to create or remove.
teams:
  # <string, required> name of the team you want to assign roles to. Required.
  - name: 'Users writers'
    # <int> org id. Will default to Grafana's default if not specified.
    orgId: 1
    # <list> list of roles to assign to the team
    roles:
      # <string> uid of the role you want to assign to the team.
      - uid: 'customuserswriter1'
        # <int> org id. Will default to Grafana's default if not specified.
        orgId: 1
      # <string> name of the role you want to assign to the team.
      - name: 'fixed:users:writer'
        # <bool> overwrite org id to specify the role is global.
        global: true
        # <string> state of the assignment. Defaults to 'present'. If 'absent', the assignment will be revoked.
        state: absent

Useful Links

Provisioning RBAC setup with Terraform

Grafana provisioning

Provisioning RBAC with Terraform

Fri, 03 Apr 2026 19:43:06 +0000

Provisioning RBAC with Terraform

Note
Available in Grafana Enterprise and Grafana Cloud.

You can create, change or remove Custom roles and create or remove basic and custom role assignments, by using Terraform’s Grafana provider.

Before you begin

Ensure you have the grafana/grafana Terraform provider 1.29.0 or higher.
Ensure you are using Grafana 9.2 or higher.

Create a Service Account Token for provisioning

We recommend using service account tokens for provisioning. Service accounts support fine grained permissions, which allows you to easily authenticate and use the minimum set of permissions needed to provision your RBAC infrastructure.

To create a service account token for provisioning, complete the following steps.

Create a new service account for your CI pipeline.
Assign permissions to service account:
- You will need roles “Role reader”, “Role writer” and roles including any permissions that will be provisioned. For example, to create or assign a role that allows creating users, a service account needs permissions to create users.
- Alternatively, you can assign “Admin” basic role to the service account.
Create a new service account token for use in Terraform.

Alternatively, you can use basic authentication. To view all the supported authentication formats, see here.

Configure the Terraform provider

RBAC support is included as part of the Grafana Terraform provider.

The following is an example you can use to configure the Terraform provider.

terraform {
    required_providers {
        grafana = {
            source = "grafana/grafana"
            version = ">= 1.29.0"
        }
    }
}

provider "grafana" {
    url = <YOUR_GRAFANA_URL>
    auth = <YOUR_GRAFANA_SERVICE_ACCOUNT_TOKEN>
}

Provision basic roles

The following example shows how to assign basic roles to users and service accounts. Basic roles are predefined in Grafana and provide a set of permissions for common use cases.

Basic role	UID
`None`	`basic_none`
`Viewer`	`basic_viewer`
`Editor`	`basic_editor`
`Admin`	`basic_admin`
`Grafana Admin`	`basic_grafana_admin`

You can use any of the basic role UIDs from the table above in your role assignments. For example, to assign the “None” role, use basic_none as the role_uid.

Note
You can’t assign basic roles to teams. To grant team permissions, assign a fixed or custom role to the team.

resource "grafana_user" "editor_user" {
  email    = "terraform_editor@example.com"
  login    = "terraform_editor_user"
  password = <TEST_PASSWORD>
}

resource "grafana_service_account" "admin_sa" {
  name = "terraform_admin_sa"
}

# Assign Editor role to a user
resource "grafana_role_assignment" "editor_role_assignment" {
  role_uid = "basic_editor"
  users    = [grafana_user.editor_user.id]
}

# Assign Admin role to a service account
resource "grafana_role_assignment" "admin_role_assignment" {
  role_uid = "basic_admin"
  service_accounts = [grafana_service_account.admin_sa.id]
}

Assign a fixed or custom role to a team

Use fixed or custom roles to grant permissions to teams:

resource "grafana_team" "writers_team" {
  name = "terraform_writers_team"
}

# Assign a fixed role to a team
resource "grafana_role_assignment" "writers_team_fixed_role" {
  role_uid = "fixed:dashboards:writer"
  teams    = [grafana_team.writers_team.id]
}

Provision basic role to multiple users

resource "grafana_user" "editor_user_2" {
  email    = "terraform_editor_2@example.com"
  login    = "terraform_editor_2_user"
  password = <TEST_PASSWORD>
}
resource "grafana_user" "editor_user_3" {
  email    = "terraform_editor_3@example.com"
  login    = "terraform_editor_3_user"
  password = <TEST_PASSWORD>
}

# Assign Editor role to multiply users
resource "grafana_role_assignment" "editor_role_assignment" {
  role_uid = "basic_editor"
  users    = [grafana_user.editor_user_2.id, grafana_user.editor_user_3.id]
}

Provision custom roles

The following example shows how to provision a custom role with some permissions.

Copy this code block into a .tf file on your local machine.

resource "grafana_role" "my_new_role" {
  name  = "my_new_role"
  description = "My test role"
  version = 1
  uid = "newroleuid"
  global = false

  permissions {
    action = "org.users:add"
    scope = "users:*"
  }
  permissions {
    action = "org.users:write"
    scope = "users:*"
  }
  permissions {
    action = "org.users:read"
    scope = "users:*"
  }
  permissions {
	  action = "teams:create"
  }
  permissions {
	  action = "teams:read"
	  scope = "teams:*"
  }
  permissions {
	  action = "teams:write"
	  scope = "teams:*"
  }
}

Run the command terraform apply.
Go to Grafana’s UI and check that the new role appears in the role picker:

Provision role assignments

The following example shows how to provision role assignments. In this example a team, user and service account are provisioned, and the custom role from the previous example is assigned to them.

Extend the configuration file from the previous example with the following:

resource "grafana_team" "test_team" {
	name = "terraform_test_team"
}

resource "grafana_user" "test_user" {
	email = "terraform_user@test.com"
	login    = "terraform_test_user"
	password = <TEST_PASSWORD>
}

resource "grafana_service_account" "test_sa" {
  name = "terraform_test_sa"
  role = "Viewer"
}

resource "grafana_role_assignment" "my_new_role_assignment" {
  role_uid = grafana_role.my_new_role.uid
  users = [grafana_user.test_user.id]
  teams = [grafana_team.test_team.id]
  service_accounts = [grafana_service_account.test_sa.id]
}

Substitute <TEST_PASSWORD> with a test password for your test user.
Run the command terraform apply.
Go to Grafana’s UI and check that a user, team and service account have been created, and that the role has been assigned to them:

Note that instead of using a provisioned role, you can also look up the uid of an already existing fixed or custom role and use that instead. You can use the API endpoint for listing roles to look up role uids. Similarly, you can look up and use ids of users, teams and service accounts that have not been provisioned to assign roles to them.

Useful Links

RBAC setup with Grafana provisioning

Grafana Cloud Terraform provisioning

Grafana RBAC role definitions

Fri, 03 Apr 2026 19:43:06 +0000

Grafana RBAC role definitions

Note
Available in Grafana Enterprise and Grafana Cloud.

The following tables list permissions associated with basic and fixed roles. This does not include basic role assignments added by plugins or apps.

Basic role assignments

Basic role	UID	Associated fixed roles	Description
Grafana Admin	`basic_grafana_admin`
`fixed:authentication.config:writer` `fixed:general.auth.config:writer` `fixed:ldap:writer` `fixed:licensing:writer` `fixed:migrationassistant:migrator` `fixed:org.users:writer` `fixed:organization:maintainer` `fixed:plugins:maintainer` `fixed:provisioning:writer` `fixed:roles:writer` `fixed:settings:reader` `fixed:settings:writer` `fixed:stats:reader` `fixed:support.bundles:writer` `fixed:usagestats:reader` `fixed:users:writer`	Default Grafana server administrator assignments.
Admin	`basic_admin`	All roles assigned to Editor and `fixed:reports:writer` `fixed:datasources:writer` `fixed:organization:writer` `fixed:datasources.permissions:writer` `fixed:teams:writer` `fixed:dashboards:writer` `fixed:dashboards.permissions:writer` `fixed:dashboards.public:writer` `fixed:folders:writer` `fixed:folders.permissions:writer` `fixed:alerting:writer` `fixed:alerting.provisioning.secrets:reader` `fixed:alerting.provisioning:writer` `fixed:datasources.caching:writer` `fixed:plugins:writer` `fixed:library.panels:writer`	Default Grafana organization administrator assignments.
Editor	`basic_editor`	All roles assigned to Viewer and `fixed:datasources:explorer` `fixed:dashboards:creator` `fixed:folders:creator` `fixed:annotations:writer` `fixed:alerting:writer` `fixed:library.panels:creator` `fixed:library.panels:general.writer` `fixed:alerting.provisioning.provenance:writer` `fixed:queries:writer`	Default Editor assignments.
Viewer	`basic_viewer`	`fixed:datasources.id:reader` `fixed:organization:reader` `fixed:annotations:reader` `fixed:annotations.dashboard:writer` `fixed:alerting:reader` `fixed:plugins.app:reader` `fixed:dashboards.insights:reader` `fixed:datasources.insights:reader` `fixed:library.panels:general.reader` `fixed:folders.general:reader` `fixed:datasources.builtin:reader` `fixed:queries:reader`	Default Viewer assignments.
No Basic Role	n/a		Default No Basic Role

Note
Grafana Cloud stacks include additional plugin role assignments not shown here. Refer to Grafana Cloud app plugin role definitions for a complete list.

To view the full definition of a basic role including all permissions, refer to Manage RBAC roles.

Fixed role definitions

The following table has the existing built-in fixed role definitions. Other fixed roles might be added by plugins installed in Grafana. The UUID presented here can be used as an identifier for Terraform provisioning.

Caution
These UUIDs won’t be available if your instance was created before Grafana v10.2.0.

To learn how to use the roles API to determine the role UUIDs, refer to Manage RBAC roles.

Fixed role	UUID	Permissions	Description
`fixed:alerting:reader`	`fixed_O2oP1_uBFozI2i93klAkcvEWR30`	All permissions from `fixed:alerting.rules:reader` `fixed:alerting.instances:reader` `fixed:alerting.notifications:reader`	Read-only permissions for all Grafana, Mimir, Loki and Alertmanager alert rules, alerts, contact points, and notification policies.
`fixed:alerting:writer`	`fixed_-PAZgSJsDlRD8NUg-PFSeH_BkJY`	All permissions from `fixed:alerting.rules:writer` `fixed:alerting.instances:writer` `fixed:alerting.notifications:writer`	Create, update, and delete Grafana, Mimir, Loki and Alertmanager alert rules, silences, contact points, templates, mute timings, and notification policies.
`fixed:alerting.instances:reader`	`fixed_ut5fVS-Ulh_ejFoskFhJT_rYg0Y`	`alert.instances:read` for organization scope `alert.instances.external:read` for scope `datasources:*`	Read all alerts and silences in the organization produced by Grafana Alerts and Mimir and Loki alerts and silences.*
`fixed:alerting.instances:writer`	`fixed_pKOBJE346uyqMLdgWbk1NsQfEl0`	All permissions from `fixed:alerting.instances:reader` and `alert.instances:create` `alert.instances:write` for organization scope `alert.instances.external:write` for scope `datasources:*`	Create, update and expire all silences in the organization produced by Grafana, Mimir, and Loki.*
`fixed:alerting.notifications:reader`	`fixed_hmBn0lX5h1RZXB9Vaot420EEdA0`	`alert.notifications:read` for organization scope `alert.notifications.external:read` for scope `datasources:*`	Read all Grafana and Alertmanager contact points, templates, and notification policies.*
`fixed:alerting.notifications:writer`	`fixed_XplK6HPNxf9AP5IGTdB5Iun4tJc`	All permissions from `fixed:alerting.notifications:reader` and `alert.notifications:write`for organization scope `alert.notifications.external:read` for scope `datasources:*`	Create, update, and delete contact points, templates, mute timings and notification policies for Grafana and external Alertmanager.*
`fixed:alerting.provisioning:writer`	`fixed_y7pFjdEkxpx5ETdcxPvp0AgRuUo`	`alert.provisioning:read` and `alert.provisioning:write`	Create, update and delete Grafana alert rules, notification policies, contact points, templates, etc via provisioning API. *
`fixed:alerting.provisioning.secrets:reader`	`fixed_9fmzXXZZG-Od0Amy2ofEG8Uk--c`	`alert.provisioning:read` and `alert.provisioning.secrets:read`	Read-only permissions for Provisioning API and let export resources with decrypted secrets *
`fixed:alerting.provisioning.provenance:writer`	`fixed_eAxlzfkTuobvKEgXHveFMBZrOj8`	`alert.provisioning.provenance:write`	Set provenance status to alert rules, notification policies, contact points, etc. Should be used together with regular writer roles. *
`fixed:alerting.rules:reader`	`fixed_fRGKL_vAqUsmUWq5EYKnOha9DcA`	`alert.rule:read`, `alert.silences:read` for scope `folders:` `alert.rules.external:read` for scope `datasources:` `alert.notifications.time-intervals:read` `alert.notifications.receivers:list`	Read all* Grafana, Mimir, and Loki alert rules.* and read rule-specific silences
`fixed:alerting.rules:writer`	`fixed_YJJGwAalUwDZPrXSyFH8GfYBXAc`	All permissions from `fixed:alerting.rules:reader` and `alert.rule:create` `alert.rule:write` `alert.rule:delete` `alert.silences:create` `alert.silences:write` for scope `folders:` `alert.rules.external:write` for scope `datasources:`	Create, update, and delete all* Grafana, Mimir, and Loki alert rules.* and manage rule-specific silences
`fixed:annotations:reader`	`fixed_hpZnoizrfAJsrceNcNQqWYV-xNU`	`annotations:read` for scopes `annotations:type:*`	Read all annotations and annotation tags.
`fixed:annotations:writer`	`fixed_ZVW-Aa9Tzle6J4s2aUFcq1StKWE`	All permissions from `fixed:annotations:reader` `annotations:write` `annotations.create` `annotations:delete` for scope `annotations:type:*`	Read, create, update and delete all annotations and annotation tags.
`fixed:annotations.dashboard:writer`	`fixed_8A775xenXeKaJk4Cr7bchP9yXOA`	`annotations:write` `annotations.create` `annotations:delete` for scope `annotations:type:dashboard`	Create, update and delete dashboard annotations and annotation tags.
`fixed:authentication.config:writer`	`fixed_0rYhZ2Qnzs8AdB1nX7gexk3fHDw`	`settings:read` for scope `settings:auth.saml:` `settings:write` for scope `settings:auth.saml:`	Read and update authentication and SAML settings.
`fixed:general.auth.config:writer`	`fixed_QFxIT_FGtBqbIVJIwx1bLgI5z6c`	`settings:read` for scope `settings:auth:oauth_allow_insecure_email_lookup` `settings:write` for scope `settings:auth:oauth_allow_insecure_email_lookup`	Read and update the Grafana instance’s general authentication configuration settings.
`fixed:dashboards:creator`	`fixed_ZorKUcEPCM01A1fPakEzGBUyU64`	`dashboards:create` `folders:read`	Create dashboards.
`fixed:dashboards:reader`	`fixed_Sgr67JTOhjQGFlzYRahOe45TdWM`	`dashboards:read`	Read all dashboards.
`fixed:dashboards:writer`	`fixed_OK2YOQGIoI1G031hVzJB6rAJQAs`	All permissions from `fixed:dashboards:reader` and `dashboards:write` `dashboards:delete` `dashboards:create` `dashboards.permissions:read` `dashboards.permissions:write`	Read, create, update, and delete all dashboards.
`fixed:dashboards.insights:reader`	`fixed_JlBJ2_gizP8zhgaeGE2rjyZe2Rs`	`dashboards.insights:read`	Read dashboard insights data and see presence indicators.
`fixed:dashboards.permissions:reader`	`fixed_f17oxuXW_58LL8mYJsm4T_mCeIw`	`dashboards.permissions:read`	Read all dashboard permissions.
`fixed:dashboards.permissions:writer`	`fixed_CcznxhWX_Yqn8uWMXMQ-b5iFW9k`	All permissions from `fixed:dashboards.permissions:reader` and `dashboards.permissions:write`	Read and update all dashboard permissions.
`fixed:dashboards.public:writer`	`fixed_f_GHHRBciaqESXfGz2oCcooqHxs`	`dashboards.public:write`	Create, update, delete or pause a shared dashboard.
`fixed:datasources:creator`	`fixed_XX8jHREgUt-wo1A-rPXIiFlX6Zw`	`datasources:create`	Create data sources.
`fixed:datasources:explorer`	`fixed_qDzW9mzx9yM91T5Bi8dHUM2muTw`	`datasources:explore`	Enable the Explore feature. Data source permissions still apply, you can only query data sources for which you have query permissions.
`fixed:datasources:reader`	`fixed_C2x8IxkiBc1KZVjyYH775T9jNMQ`	`datasources:read` `datasources:query`	Read and query data sources.
`fixed:datasources:writer`	`fixed_q8HXq8kjjA5IlHHgBJlKlUyaNik`	All permissions from `fixed:datasources:reader` and `datasources:create` `datasources:write` `datasources:delete`	Read, query, create, delete, or update a data source.
`fixed:datasources.builtin:reader`	`fixed_q8HXq8kjjA5IlHHgBJlKlUyaNik`	`datasources:read` and `datasources:query` scoped to `datasources:uid:grafana`	An internal role used to grant Viewers access to the builtin example data source in Grafana.
`fixed:datasources.caching:reader`	`fixed_D2ddpGxJYlw0mbsTS1ek9fj0kj4`	`datasources.caching:read`	Read data source query caching settings.
`fixed:datasources.caching:writer`	`fixed_JtFjHr7jd7hSqUYcktKvRvIOGRE`	`datasources.caching:read` `datasources.caching:write`	Enable, disable, or update query caching settings.
`fixed:datasources.id:reader`	`fixed_entg--fHmDqWY2-69N0ocawK0Os`	`datasources.id:read`	Read the ID of a data source based on its name.
`fixed:datasources.insights:reader`	`fixed_EBZ3NwlfecNPp2p0XcZRC1nfEYk`	`datasources.insights:read`	Read data source insights data.
`fixed:datasources.permissions:reader`	`fixed_ErYA-cTN3yn4h4GxaVPcawRhiOY`	`datasources.permissions:read`	Read data source permissions.
`fixed:datasources.permissions:writer`	`fixed_aiQh9YDfLOKjQhYasF9_SFUjQiw`	All permissions from `fixed:datasources.permissions:reader` and `datasources.permissions:write`	Create, read, or delete permissions of a data source.
`fixed:folders:creator`	`fixed_gGLRbZGAGB6n9uECqSh_W382RlQ`	`folders:create`	Create folders in the root level.
`fixed:folders:reader`	`fixed_yeW-5QPeo-i5PZUIUXMlAA97GnQ`	`folders:read` `dashboards:read`	Read all folders and dashboards.
`fixed:folders:writer`	`fixed_wJXLoTzgE7jVuz90dryYoiogL0o`	All permissions from `fixed:dashboards:writer` and `folders:read` `folders:write` `folders:create` `folders:delete` `folders.permissions:read` `folders.permissions:write`	Read, update, and delete all folders and dashboards. Create folders and subfolders.
`fixed:folders.general:reader`	`fixed_rSASbkg8DvpG_gTX5s41d7uxRvI`	`folders:read` scoped to `folders:uid:general`	An internal role used to correctly display access to the folder tree for Viewer role.
`fixed:folders.permissions:reader`	`fixed_E06l4cx0JFm47EeLBE4nmv3pnSo`	`folders.permissions:read`	Read all folder permissions.
`fixed:folders.permissions:writer`	`fixed_3GAgpQ_hWG8o7-lwNb86_VB37eI`	All permissions from `fixed:folders.permissions:reader` and `folders.permissions:write`	Read and update all folder permissions.
`fixed:ldap:reader`	`fixed_lMcOPwSkxKY-qCK8NMJc5k6izLE`	`ldap.user:read` `ldap.status:read`	Read the LDAP configuration and LDAP status information.
`fixed:ldap:writer`	`fixed_p6AvnU4GCQyIh7-hbwI-bk3GYnU`	All permissions from `fixed:ldap:reader` and `ldap.user:sync` `ldap.config:reload`	Read and update the LDAP configuration, and read LDAP status information.
`fixed:library.panels:creator`	`fixed_6eX6ItfegCIY5zLmPqTDW8ZV7KY`	`library.panels:create` `folders:read`	Create library panel at the root level.
`fixed:library.panels:general.reader`	`fixed_ct0DghiBWR_2BiQm3EvNPDVmpio`	`library.panels:read`	Read all library panels at the root level.
`fixed:library.panels:general.writer`	`fixed_DgprkmqfN_1EhZ2v1_d1fYG8LzI`	All permissions from `fixed:library.panels:general.reader` plus `library.panels:create` `library.panels:delete` `library.panels:write`	Create, read, write or delete all library panels and their permissions at the root level.
`fixed:library.panels:reader`	`fixed_tvTr9CnZ6La5vvUO_U_X1LPnhUs`	`library.panels:read`	Read all library panels.
`fixed:library.panels:writer`	`fixed_JTljAr21LWLTXCkgfBC4H0lhBC8`	All permissions from `fixed:library.panels:reader` plus `library.panels:create` `library.panels:delete` `library.panels:write`	Create, read, write or delete all library panels and their permissions.
`fixed:licensing:reader`	`fixed_OADpuXvNEylO2Kelu3GIuBXEAYE`	`licensing:read` `licensing.reports:read`	Read licensing information and licensing reports.
`fixed:licensing:writer`	`fixed_gzbz3rJpQMdaKHt-E4q0PVaKMoE`	All permissions from `fixed:licensing:reader` and `licensing:write` `licensing:delete`	Read licensing information and licensing reports, update and delete the license token.
`fixed:migrationassistant:migrator`	`fixed_LLk2p7TRuBztOAksTQb1Klc8YTk`	`migrationassistant:migrate`	Execute on-prem to cloud migrations through the Migration Assistant.
`fixed:org.users:reader`	`fixed_oCqNwlVHLOpw7-jAlwp4HzYqwGY`	`org.users:read`	Read users within a single organization.
`fixed:org.users:writer`	`fixed_VERj5nayasjgf_Yh0sWqqCkxWlw`	All permissions from `fixed:org.users:reader` and `org.users:add` `org.users:remove` `org.users:write`	Within a single organization, add a user, invite a new user, read information about a user and their role, remove a user from that organization, or change the role of a user.
`fixed:organization:maintainer`	`fixed_CMm-uuBaPUBf4r8XG3jIvxo55bg`	All permissions from `fixed:organization:reader` and `orgs:write` `orgs:create` `orgs:delete` `orgs.quotas:write`	Create, read, write, or delete an organization. Read or write its quotas. This role needs to be assigned globally.
`fixed:organization:reader`	`fixed_0SZPJlTHdNEe8zO91zv7Zwiwa2w`	`orgs:read` `orgs.quotas:read`	Read an organization and its quotas.
`fixed:organization:writer`	`fixed_Y4jGqDd8w1yCrPwlik8z5Iu8-3M`	All permissions from `fixed:organization:reader` and `orgs:write` `orgs.preferences:read` `orgs.preferences:write`	Read an organization, its quotas, or its preferences. Update organization properties, or its preferences.
`fixed:plugins:maintainer`	`fixed_yEOKidBcWgbm74x-nTa3lW5lOyY`	`plugins:install`	Install and uninstall plugins. Needs to be assigned globally.
`fixed:plugins:writer`	`fixed_MRYpGk7kpNNwt2VoVOXFiPnQziE`	`plugins:write`	Enable and disable plugins and edit plugins’ settings.
`fixed:plugins.app:reader`	`fixed_AcZRiNYx7NueYkUqzw1o2OGGUAA`	`plugins.app:access`	Access application plugins (still enforcing the organization role).
`fixed:provisioning:writer`	`fixed_bgk1FCyR6OEDwhgirZlQgu5LlCA`	`provisioning:reload`	Reload provisioning.
`fixed:queries:reader`	`fixed_-rEsxR-pZg1-fQL-XDQaouEpK98`	`queries:read`	Read saved queries.
`fixed:queries:writer`	`fixed_7TMOlueweuPX_PhffesRB2FTQn4`	All permissions from `fixed:queries:reader` and `queries:write`	Create, update, and delete saved queries.
`fixed:reports:reader`	`fixed_72_8LU_0ukfm6BdblOw8Z9q-GQ8`	`reports:read` `reports:send` `reports.settings:read`	Read all reports and shared report settings.
`fixed:reports:writer`	`fixed_jBW3_7g1EWOjGVBYeVRwtFxhUNw`	All permissions from `fixed:reports:reader` and `reports:create` `reports:write` `reports:delete` `reports.settings:write`	Create, read, update, or delete all reports and shared report settings.
`fixed:roles:reader`	`fixed_GkfG-1NSwEGb4hpK3-E3qHyNltc`	`roles:read` `teams.roles:read` `users.roles:read` `users.permissions:read`	Read all access control roles, roles and permissions assigned to users, teams.
`fixed:roles:resetter`	`fixed_WgPpC3qJRmVpVTJavFNwfS5RuzQ`	`roles:write` with scope `permissions:type:escalate`	Reset basic roles to their default.
`fixed:roles:writer`	`fixed_W5aFaw8isAM27x_eWfElBhZ0iOc`	All permissions from `fixed:roles:reader` and `roles:write` `roles:delete` `teams.roles:add` `teams.roles:remove` `users.roles:add` `users.roles:remove`	Create, read, update, or delete all roles, assign or unassign roles to users, teams.
`fixed:serviceaccounts:creator`	`fixed_Ikw60fckA0MyiiZ73BawSfOULy4`	`serviceaccounts:create`	Create Grafana service accounts.
`fixed:serviceaccounts:reader`	`fixed_QFjJAZ88iawMLInYOxPA1DB1w6I`	`serviceaccounts:read`	Read Grafana service accounts.
`fixed:serviceaccounts:writer`	`fixed_iBvUNUEZBZ7PUW0vdkN5iojc2sk`	`serviceaccounts:read` `serviceaccounts:create` `serviceaccounts:write` `serviceaccounts:delete` `serviceaccounts.permissions:read` `serviceaccounts.permissions:write`	Create, update, read and delete all Grafana service accounts and manage service account permissions.
`fixed:settings:reader`	`fixed_0LaUt1x6PP8hsZzEBhqPQZFUd8Q`	`settings:read`	Read Grafana instance settings.
`fixed:settings:writer`	`fixed_joIHDgMrGg790hMhUufVzcU4j44`	All permissions from `fixed:settings:reader` and `settings:write`	Read and update Grafana instance settings.
`fixed:stats:reader`	`fixed_OnRCXxZVINWpcKvTF5A1gecJ7pA`	`server.stats:read`	Read Grafana instance statistics.
`fixed:support.bundles:reader`	`fixed_gcPjI3PTUJwRx-GJZwDhNa7zbos`	`support.bundles:read`	List and download support bundles.
`fixed:support.bundles:writer`	`fixed_dTgCv9Wxrp_WHAhwHYIgeboxKpE`	`support.bundles:read` `support.bundles:create` `support.bundles:delete`	Create, delete, list and download support bundles.
`fixed:teams:creator`	`fixed_nzVQoNSDSn0fg1MDgO6XnZX2RZI`	`teams:create` `org.users:read`	Create a team and list organization users (required to manage the created team).
`fixed:teams:read`	`fixed_Z8pB0GQlrqRt8IZBCJQxPWvJPgQ`	`teams:read`	List all teams.
`fixed:teams:writer`	`fixed_xw1T0579h620MOYi4L96GUs7fZY`	`teams:create` `teams:delete` `teams:read` `teams:write` `teams.permissions:read` `teams.permissions:write`	Create, read, update and delete teams and manage team memberships.
`fixed:usagestats:reader`	`fixed_eAM0azEvnWFCJAjNkUKnGL_1-bU`	`server.usagestats.report:read`	View usage statistics report.
`fixed:users:reader`	`fixed_buZastUG3reWyQpPemcWjGqPAd0`	`users:read` `users.quotas:read` `users.authtoken:read`	Read all users and their information, such as team memberships, authentication tokens, and quotas.
`fixed:users:writer`	`fixed_wjzgHHo_Ux25DJuELn_oiAdB_yM`	All permissions from `fixed:users:reader` and `users:write` `users:create` `users:delete` `users:enable` `users:disable` `users.password:write` `users.permissions:write` `users:logout` `users.authtoken:write` `users.quotas:write`	Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users.

Alerting roles

You can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.

Access to Grafana alert rules is an intersection of many permissions:

Permission to read a folder. For example, the fixed role fixed:folders:reader includes the action folders:read and a folder scope folders:id:.
Permission to query all data sources that a given alert rule uses. If a user cannot query a given data source, they cannot see any alert rules that query that data source.

There is only one exclusion. Role fixed:alerting.provisioning:writer does not require user to have any additional permissions and provides access to all aspects of the alerting configuration via special provisioning API.

For more information about the permissions required to access alert rules, refer to Create a custom role to access alerts in a folder.

Alerting basic roles

The following table lists the default RBAC alerting role assignments to the basic roles:

Basic role	Associated fixed roles	Description
Admin	`fixed:alerting:writer` `fixed:alerting.provisioning.secrets:reader` `fixed:alerting.provisioning:writer`	Default Grafana organization administrator assignments.
Editor	`fixed:alerting:writer` `fixed:alerting.provisioning.provenance:writer`	Default Editor assignments.
Viewer	`fixed:alerting:reader`	Default Viewer assignments.

Grafana RBAC permissions, actions, and scopes

Fri, 03 Apr 2026 19:43:06 +0000

RBAC permissions, actions, and scopes

Note
Available in Grafana Enterprise and Grafana Cloud.

A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resources on which they can perform those actions.

To learn more about the Grafana resources to which you can apply RBAC, refer to Resources with RBAC permissions.

Note
Before creating custom roles, consider whether you can meet your access requirements using:

Folder permissions: Control access to dashboards, alert rules, and other resources by folder

Fixed roles: Pre-built roles for common access patterns

Custom roles are most useful when you need fine-grained control that these options don’t provide.

Action: An action describes what tasks a user can perform on a resource.
Scope: A scope describes where an action can be performed, such as reading a specific user profile. In this example, a permission is associated with the scope users:<userId> to the relevant role.

Action definitions

The following list contains role-based access control actions.

Action	Applicable scopes	Description
`alert.instances.external:read`	`datasources:` `datasources:uid:`	Read alerts and silences in data sources that support alerting.
`alert.instances.external:write`	`datasources:` `datasources:uid:`	Manage alerts and silences in data sources that support alerting.
`alert.instances:create`	None	Create silences in the current organization.
`alert.instances:read`	None	Read alerts and silences in the current organization.
`alert.instances:write`	None	Update and expire silences in the current organization.
`alert.notifications.external:read`	`datasources:` `datasources:uid:`	Read templates, contact points, notification policies, and mute timings in data sources that support alerting.
`alert.notifications.external:write`	`datasources:` `datasources:uid:`	Manage templates, contact points, notification policies, and mute timings in data sources that support alerting.
`alert.notifications:write`	None	Manage templates, contact points, notification policies, and mute timings in the current organization.
`alert.notifications:read`	None	Read all templates, contact points, notification policies, and mute timings in the current organization.
`alert.rules.external:read`	`datasources:` `datasources:uid:`	Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki)
`alert.rules.external:write`	`datasources:` `datasources:uid:`	Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki).
`alert.rules:create`	`folders:` `folders:uid:`	Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.
`alert.rules:delete`	`folders:` `folders:uid:`	Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder.
`alert.rules:read`	`folders:` `folders:uid:`	Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.
`alert.rules:write`	`folders:` `folders:uid:`	Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. To allow query modifications add `datasources:query` in the scope of data sources the user can query.
`alert.silences:create`	`folders:` `folders:uid:`	Create rule-specific silences in a folder and its subfolders.
`alert.silences:read`	`folders:` `folders:uid:`	Read all general silences and rule-specific silences in a folder and its subfolders.
`alert.silences:write`	`folders:` `folders:uid:`	Update and expire rule-specific silences in a folder and its subfolders.
`alert.provisioning:read`	None	Read all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.
`alert.provisioning.secrets:read`	None	Same as `alert.provisioning:read` plus ability to export resources with decrypted secrets.
`alert.provisioning:write`	None	Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.
`alert.provisioning.provenance:write`	None	Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources
`annotations:create`	`annotations:` `annotations:type:` `dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Create annotations.
`annotations:delete`	`annotations:` `annotations:type:` `dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Delete annotations.
`annotations:read`	`annotations:` `annotations:type:` `dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Read annotations and annotation tags.
`annotations:write`	`annotations:` `annotations:type:` `dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Update annotations.
`banners:write`	None	Create announcement banners.
`dashboards:create`	`folders:` `folders:uid:`	Create dashboards in one or more folders and their subfolders.
`dashboards:delete`	`dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Delete one or more dashboards.
`dashboards.insights:read`	None	Read dashboard insights data and see presence indicators. To view insights, `dashboards:read` on the dashboard is also needed.
`dashboards.permissions:read`	`dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Read permissions for one or more dashboards.
`dashboards.permissions:write`	`dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Update permissions for one or more dashboards.
`dashboards:read`	`dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Read one or more dashboards.
`dashboards:write`	`dashboards:` `dashboards:uid:` `folders:` `folders:uid:`	Update one or more dashboards.
`dashboards.public:write`	`dashboards:` `dashboards:uid:`	Write shared dashboard configuration.
`datasources.caching:read`	`datasources:` `datasources:uid:`	Read data source query caching settings.
`datasources.caching:write`	`datasources:` `datasources:uid:`	Update data source query caching settings.
`datasources:create`	None	Create data sources.
`datasources:delete`	`datasources:` `datasources:uid:`	Delete data sources.
`datasources:explore`	None	Enable access to the Explore tab.
`datasources.id:read`	`datasources:` `datasources:uid:`	Read data source IDs.
`datasources.insights:read`	None	Read data sources insights data. To view insights, `datasources:read` on the datasource is also needed.
`datasources.permissions:read`	`datasources:` `datasources:uid:`	List data source permissions.
`datasources.permissions:write`	`datasources:` `datasources:uid:`	Update data source permissions.
`datasources:query`	`datasources:` `datasources:uid:`	Query data sources.
`datasources:read`	`datasources:` `datasources:uid:`	List data sources.
`datasources:write`	`datasources:` `datasources:uid:`	Update data sources.
`featuremgmt.read`	None	Read feature toggles.
`featuremgmt.write`	None	Write feature toggles.
`folders.permissions:read`	`folders:` `folders:uid:`	Read permissions for one or more folders and their subfolders.
`folders.permissions:write`	`folders:` `folders:uid:`	Update permissions for one or more folders and their subfolders.
`folders:create`	`folders:` `folders:uid:` `folders:uid:general`	Create folders or subfolders. If granted with scope `folders:uid:general`, it allows to create root level folders. Otherwise, it allows creating subfolders under the specified folders.
`folders:delete`	`folders:` `folders:uid:`	Delete one or more folders and their subfolders.
`folders:read`	`folders:` `folders:uid:`	Read one or more folders and their subfolders.
`folders:write`	`folders:` `folders:uid:`	Update one or more folders and their subfolders.
`ldap.config:reload`	None	Reload the LDAP configuration.
`ldap.status:read`	None	Verify the availability of the LDAP server or servers.
`ldap.user:read`	None	Read users via LDAP.
`ldap.user:sync`	None	Sync users via LDAP.
`library.panels:create`	`folders:` `folders:uid:`	Create a library panel in one or more folders and their subfolders.
`library.panels:read`	`folders:` `folders:uid:` `library.panels:` `library.panels:uid:`	Read one or more library panels.
`library.panels:write`	`folders:` `folders:uid:` `library.panels:` `library.panels:uid:`	Update one or more library panels.
`library.panels:delete`	`folders:` `folders:uid:` `library.panels:` `library.panels:uid:`	Delete one or more library panels.
`licensing.reports:read`	None	Get custom permission reports.
`licensing:delete`	None	Delete the license token.
`licensing:read`	None	Read licensing information.
`licensing:write`	None	Update the license token.
`migrationassistant:migrate`	None	Execute on-prem to cloud migrations through the Migration Assistant.
`org.users:write`	`users:` `users:id:`	Update the organization role (`None`, `Viewer`, `Editor`, or `Admin`) of a user.
`org.users:add`	`users:` `users:id:`	Add a user to an organization or invite a new user to an organization.
`org.users:read`	`users:` `users:id:`	Get user profiles within an organization.
`org.users:remove`	`users:` `users:id:`	Remove a user from an organization.
`orgs.preferences:read`	None	Read organization preferences.
`orgs.preferences:write`	None	Update organization preferences.
`orgs.quotas:read`	None	Read organization quotas.
`orgs.quotas:write`	None	Update organization quotas.
`orgs:create`	None	Create an organization.
`orgs:delete`	None	Delete one or more organizations.
`orgs:read`	None	Read one or more organizations.
`orgs:write`	None	Update one or more organizations.
`plugins.app:access`	`plugins:` `plugins:id:`	Access one or more application plugins (still enforcing the organization role)
`plugins:install`	None	Install and uninstall plugins.
`plugins:write`	`plugins:` `plugins:id:`	Edit settings for one or more plugins.
`provisioning:reload`	`provisioners:*`	Reload provisioning files. To find the exact scope for specific provisioner, refer to Scope definitions.
`reports:create`	None	Create reports.
`reports:write`	`reports:` `reports:id:`	Update reports.
`reports.settings:read`	None	Read report settings.
`reports.settings:write`	None	Update report settings.
`reports:delete`	`reports:` `reports:id:`	Delete reports.
`reports:read`	`reports:` `reports:id:`	List all available reports or get a specific report.
`reports:send`	`reports:` `reports:id:`	Send a report email.
`roles:delete`	`permissions:type:delegate`	Delete a custom role.
`roles:read`	`roles:` `roles:uid:`	List roles and read a specific role with its permissions.
`roles:write`	`permissions:type:delegate`	Create or update a custom role.
`roles:write`	`permissions:type:escalate`	Reset basic roles to their default permissions.
`secret.securevalues:create`	`secret.securevalues:*`	Create secure values.
`secret.securevalues:read`	`secret.securevalues:*`	Read and list secure values.
`secret.securevalues:write`	`secret.securevalues:*`	Update secure values.
`secret.securevalues:delete`	`secret.securevalues:*`	Delete secure values.
`server.stats:read`	None	Read Grafana instance statistics.
`server.usagestats.report:read`	None	View usage statistics report.
`serviceaccounts:write`	`serviceaccounts:*`	Create Grafana service accounts.
`serviceaccounts:create`	None	Update Grafana service accounts.
`serviceaccounts:delete`	`serviceaccounts:` `serviceaccounts:id:`	Delete Grafana service accounts.
`serviceaccounts:read`	`serviceaccounts:` `serviceaccounts:id:`	Read Grafana service accounts.
`serviceaccounts.permissions:write`	`serviceaccounts:` `serviceaccounts:id:`	Update Grafana service account permissions to control who can do what with the service account.
`serviceaccounts.permissions:read`	`serviceaccounts:` `serviceaccounts:id:`	Read Grafana service account permissions to see who can do what with the service account.
`settings:read`	`settings:` `settings:auth.saml:` `settings:auth.saml:enabled` (property level)	Read the Grafana configuration settings
`settings:write`	`settings:` `settings:auth.saml:` `settings:auth.saml:enabled` (property level)	Update any Grafana configuration settings that can be updated at runtime.
`support.bundles:create`	None	Create support bundles.
`support.bundles:delete`	None	Delete support bundles.
`support.bundles:read`	None	List and download support bundles.
`snapshots:create`	None	Create snapshots.
`snapshots:delete`	None	Delete snapshots.
`snapshots:read`	None	List snapshots.
`status:accesscontrol`	`services:accesscontrol`	Get access-control enabled status.
`teams.permissions:read`	`teams:` `teams:id:`	Read members and Team Sync setup for teams.
`teams.permissions:write`	`teams:` `teams:id:`	Add, remove and update members and manage Team Sync setup for teams.
`teams.roles:add`	`permissions:type:delegate`	Assign a role to a team.
`teams.roles:read`	`teams:` `teams:id:`	List roles assigned directly to a team.
`teams.roles:remove`	`permissions:type:delegate`	Unassign a role from a team.
`teams:create`	None	Create teams.
`teams:delete`	`teams:` `teams:id:`	Delete one or more teams.
`teams:read`	`teams:` `teams:id:`	Read one or more teams and team preferences. To list teams through the UI one of the following permissions is required in addition to `teams:read`: `teams:write`, `teams.permissions:read` or `teams.permissions:write`.
`teams:write`	`teams:` `teams:id:`	Update one or more teams and team preferences.
`users.authtoken:read`	`global.users:` `global.users:id:`	List authentication tokens that are assigned to a user.
`users.authtoken:write`	`global.users:` `global.users:id:`	Update authentication tokens that are assigned to a user.
`users.password:write`	`global.users:` `global.users:id:`	Update a user’s password.
`users.permissions:read`	`users:*`	List permissions of a user.
`users.permissions:write`	`global.users:` `global.users:id:`	Update a user’s organization-level permissions.
`users.quotas:read`	`global.users:` `global.users:id:`	List a user’s quotas.
`users.quotas:write`	`global.users:` `global.users:id:`	Update a user’s quotas.
`users.roles:add`	`permissions:type:delegate`	Assign a role to a user or a service account.
`users.roles:read`	`users:*`	List roles assigned directly to a user or a service account.
`users.roles:remove`	`permissions:type:delegate`	Unassign a role from a user or a service account.
`users:create`	None	Create a user.
`users:delete`	`global.users:` `global.users:id:`	Delete a user.
`users:disable`	`global.users:` `global.users:id:`	Disable a user.
`users:enable`	`global.users:` `global.users:id:`	Enable a user.
`users:logout`	`global.users:` `global.users:id:`	Sign out a user.
`users:read`	`global.users:*`	Read or search user profiles.
`users:write`	`global.users:` `global.users:id:`	Update a user’s profile.

Grafana Alerting Notification action definitions

Action	Applicable scopes	Description
`alert.notifications.receivers:read`	`receivers:` `receivers:uid:`	Read contact points.
`alert.notifications.receivers.secrets:read`	`receivers:` `receivers:uid:`	Export contact points with decrypted secrets.
`alert.notifications.receivers:create`	None	Create a new contact points. The creator is automatically granted full access to the created contact point.
`alert.notifications.receivers:write`	`receivers:` `receivers:uid:`	Update existing contact points.
`alert.notifications.receivers.protected:write`	`receivers:` `receivers:uid:`	Update protected fields in contact points (such as target URLs for integrations). This scope only applies to Grafana Cloud.
`alert.notifications.receivers:delete`	`receivers:` `receivers:uid:`	Update and delete existing contact points.
`alert.notifications.receivers:test`	None	Test contact point notification. Deprecated. Use “alert.notifications.receivers.test:create”
`alert.notifications.receivers.test:create`	`receivers:` `receivers:uid:` `receivers:uid:-`	Test contact points to verify their configuration. Use scope `receivers:uid:-` to grant permission to test new integrations
`receivers.permissions:read`	`receivers:` `receivers:uid:`	Read permissions for contact points.
`receivers.permissions:write`	`receivers:` `receivers:uid:`	Manage permissions for contact points.
`alert.notifications.time-intervals:read`	None	Read mute time intervals.
`alert.notifications.time-intervals:write`	None	Create new or update existing mute time intervals.
`alert.notifications.time-intervals:delete`	None	Delete existing time intervals.
`alert.notifications.templates:read`	None	Read templates.
`alert.notifications.templates:write`	None	Create new or update existing templates.
`alert.notifications.templates:delete`	None	Delete existing templates.
`alert.notifications.templates.test:write`	None	Test templates with custom payloads (preview and payload editor functionality).
`alert.notifications.routes:read`	None	Read notification policies.
`alert.notifications.routes:write`	None	Create new, update or delete notification policies

Scope definitions

The following list contains role-based access control scopes.

Scopes	Descriptions
`annotations:` `annotations:type:`	Restrict an action to a set of annotations. For example, `annotations:*` matches any annotation, `annotations:type:dashboard` matches annotations associated with dashboards and `annotations:type:organization` matches organization annotations.
`dashboards:` `dashboards:uid:`	Restrict an action to a set of dashboards. For example, `dashboards:*` matches any dashboard, and `dashboards:uid:1` matches the dashboard whose UID is `1`.
`datasources:` `datasources:uid:`	Restrict an action to a set of data sources. For example, `datasources:*` matches any data source, and `datasources:uid:1` matches the data source whose UID is `1`.
`folders:` `folders:uid:`	Restrict an action to a set of folders. For example, `folders:*` matches any folder, and `folders:uid:1` matches the folder whose UID is `1`. Note that permissions granted to a folder cascade down to subfolders located under it.
`global.users:` `global.users:id:`	Restrict an action to a set of global users. For example, `global.users:*` matches any user and `global.users:id:1` matches the user whose ID is `1`.
`library.panels:` `library.panels:uid:`	Restrict an action to a set of library panels. For example, `library.panels:*` matches any library panel, and `library.panel:uid:1` matches the library panel whose UID is `1`.
`orgs:` `orgs:id:`	Restrict an action to a set of organizations. For example, `orgs:*` matches any organization and `orgs:id:1` matches the organization whose ID is `1`.
`permissions:type:delegate`	The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
`permissions:type:escalate`	The scope is required to trigger the reset of basic roles permissions. It indicates that users might acquire additional permissions they did not previously have.
`plugins:` `plugins:id:`	Restrict an action to a set of plugins. For example, `plugins:id:grafana-oncall-app` matches Grafana OnCall plugin, and `plugins:*` matches all plugins.
`provisioners:*`	Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the role-based access control provisioner.
`reports:` `reports:id:`	Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:id:1` matches the report whose ID is `1`.
`roles:` `roles:uid:`	Restrict an action to a set of roles. For example, `roles:*` matches any role and `roles:uid:randomuid` matches only the role whose UID is `randomuid`.
`services:accesscontrol`	Restrict an action to target only the role-based access control service. You can use this in conjunction with the `status:accesscontrol` actions.
`serviceaccounts:` `serviceaccounts:id:`	Restrict an action to a set of service account from an organization. For example, `serviceaccounts:*` matches any service account and `serviceaccount:id:1` matches the service account whose ID is `1`.
`settings:*`	Restrict an action to a subset of settings. For example, `settings:` matches all settings, `settings:auth.saml:` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings.
`teams:` `teams:id:`	Restrict an action to a set of teams from an organization. For example, `teams:*` matches any team and `teams:id:1` matches the team whose ID is `1`.
`users:` `users:id:`	Restrict an action to a set of users from an organization. For example, `users:*` matches any user and `users:id:1` matches the user whose ID is `1`.
None	If an action has “None” specified for the scope, then the action doesn’t require a scope. For example, the `teams:create` action doesn’t require a scope and allows users to create teams.

Discovering plugin actions

The action definitions table above lists actions for core Grafana features. App plugins can define their own actions, which follow the pattern <plugin-id>.<resource>:<operation>.

To discover which actions a plugin supports, query an existing role that has plugin permissions. For example, to see what actions are available for a plugin, you can query the basic Admin role:

curl -X GET "https://your-grafana-instance/api/access-control/roles/basic_admin" \
  -H "Authorization: Bearer <your-service-account-token>"

The response includes all permissions granted to that role, including plugin-specific actions. Plugin actions typically use None for their scope because they operate at the organization level.

For a centralized reference of plugin roles and their default permissions, refer to Grafana Cloud app plugin role definitions.

RBAC for app plugins

Fri, 03 Apr 2026 19:43:06 +0000

RBAC for app plugins

Note
Available in Grafana Enterprise and Grafana Cloud.

RBAC can be used to manage access to app plugins. Each app plugin grants the basic Viewer, Editor and Admin organization roles a default set of plugin permissions. You can use RBAC to restrict which app plugins a basic organization role has access to. Some app plugins have fine-grained RBAC support, which allows you to grant additional access to these app plugins to teams and users regardless of their basic organization roles.

Restricting access to app plugins

By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access. To change this default behavior and prevent a basic organization role from accessing an App plugin, you must update the basic role’s permissions. See an example of preventing Viewers from accessing an app plugin to learn more. To grant access to a limited set of app plugins, you will need plugin IDs. You can find them in plugin.json files or in the URL when you open the app plugin in the Grafana Cloud UI.

Note that unless an app plugin has fine-grained RBAC support, it is not possible to grant access to this app plugin for a user whose organization role does not have access to that app plugin.

Fine-grained access to app plugins

Plugins with fine-grained RBAC support allow you to manage access to plugin features at a more granular level. For instance, you can grant admin access to an app plugin to a user with Viewer organization role. Or restrict the Editor organization role from being able to edit plugin resources.

For a centralized reference of all Grafana Cloud app plugin roles, default permissions by basic role, and available plugin roles, refer to Grafana Cloud app plugin role definitions. Some plugins also have dedicated RBAC documentation with additional context and use cases, linked in the table below.

The following table lists app plugins that have fine-grained RBAC support:

App plugin	App plugin ID	App plugin permission documentation
Access policies	`grafana-auth-app`	Plugin role definitions
Adaptive Logs	`grafana-adaptivelogs-app`	Plugin role definitions
Adaptive Metrics	`grafana-adaptive-metrics-app`	Plugin role definitions
Adaptive Traces	`grafana-adaptivetraces-app`	Plugin role definitions
Application Observability	`grafana-app-observability-app`	Plugin role definitions
Attributions	`grafana-attributions-app`	Plugin role definitions
Cloud Provider	`grafana-csp-app`	Cloud Provider Observability role-based access control
Cost Management and Billing	`grafana-cmab-app`	Plugin role definitions
Fleet Management	`grafana-collector-app`	Role-based access control for Fleet Management
Frontend Observability	`grafana-kowalski-app`	Plugin role definitions
Grafana Assistant	`grafana-assistant-app`	Plugin role definitions
Incident	`grafana-incident-app`	Plugin role definitions
Integrations and Connections	`grafana-easystart-app`	Plugin role definitions
IRM	`grafana-irm-app`	Plugin role definitions
IRM Labels	`grafana-labels-app`	Plugin role definitions
Knowledge Graph	`grafana-asserts-app`	Plugin role definitions
Kubernetes Monitoring	`grafana-k8s-app`	Kubernetes Monitoring role-based access control
Machine Learning	`grafana-ml-app`	Plugin role definitions
OnCall	`grafana-oncall-app`	Configure RBAC for OnCall
Performance Testing (k6)	`k6-app`	Configure RBAC for k6
Private data source connect (PDC)	`grafana-pdc-app`	Plugin role definitions
Service Level Objective (SLO)	`grafana-slo-app`	Configure RBAC for SLO
Synthetic Monitoring	`grafana-synthetic-monitoring-app`	Configure RBAC for Synthetic Monitoring

Revoke fine-grained access from app plugins

To list all the permissions granted to a basic role, use the HTTP API endpoint to query for the role. Basic role UIDs are listed in RBAC role definitions list. To remove the undesired plugin permissions from a basic role, you must update the basic role’s permissions.

Grant additional access to app plugins

To grant access to app plugins, you can use the predefined fixed plugin roles or create custom roles with specific plugin permissions. To learn about how to assign an RBAC role, refer to the documentation on assigning RBAC roles.

Grafana Cloud app plugin role definitions

Fri, 03 Apr 2026 19:43:06 +0000

Grafana Cloud app plugin role definitions

Note
Available in Grafana Cloud.

This page lists the RBAC roles available for Grafana Cloud app plugins. Plugin roles control access to specific plugin features and can be assigned to users, teams, or basic roles.

For general information about how RBAC works with app plugins, refer to RBAC for app plugins.

Note
Third-party plugins can define their own RBAC roles. This page documents roles for Grafana Cloud app plugins only. Refer to the documentation for third-party plugins to learn about their available roles.

Default plugin permissions by basic role

When you assign a user a basic organization role (Viewer, Editor, or Admin), they automatically receive default plugin permissions. The following table summarizes the default access level for each Grafana Cloud plugin.

Plugin	Viewer	Editor	Admin
Adaptive Logs	Read exemptions	Read exemptions	Admin access
Adaptive Metrics	Read recommendations, exemptions	Read recommendations, exemptions	Admin access
Adaptive Traces	Read recommendations	Read recommendations	Admin access
Application Observability	View access	View access	Admin access
Assistant	Chat access, user rules/quickstarts	+ MCP servers, investigations	+ Tenant-wide settings
Cloud Provider	Read access	Read access	Provider-specific write access
Cost Attributions	Read attributions	Read attributions	Read attributions
Cost Management and Billing	—	—	Full access
Fleet Management (Collector)	Read access	Read access	Full access
Frontend Observability	Read apps, source maps	+ Write apps, source maps	+ Delete apps
Grafana Auth	—	—	Write access policies
IRM	Read all	+ Write alert groups, schedules, maintenance, user settings	+ Write integrations, escalation chains, etc.
k6	Read settings	+ Write settings	Admin access
Knowledge Graph	Read assertions	+ Write configuration and rules	+ Full write access
Kubernetes Monitoring	Read all	Read all	Admin access
Labels	Read labels	+ Create, edit, delete labels	+ Full write access
Machine Learning	Read forecasting, outliers, sift	+ Write forecasting, outliers, sift	+ Full write access
OnCall	Read all	+ Write alert groups, schedules, maintenance, user settings	+ Write integrations, escalation chains, etc.
Private Data Connect	—	—	Full access
SLO	Read SLOs	Create, edit, delete SLOs	+ Modify org preferences
Synthetic Monitoring	Read checks, probes, alerts, thresholds	+ Create, edit, delete checks, probes, alerts, thresholds	+ Manage access tokens

Note
The permissions above are automatically granted based on the user’s organization role. You can assign additional plugin-specific roles (listed below) to grant more granular access.

Adaptive Logs plugin

Plugin ID: grafana-adaptivelogs-app

Plugin role	Description
`plugins:grafana-adaptivelogs-app:admin`	Read/write access to everything in Adaptive Logs
`plugins:grafana-adaptivelogs-app:patterns-editor`	Read/write access to recommendations and patterns
`plugins:grafana-adaptivelogs-app:patterns-reader`	Read access to recommendations and patterns
`plugins:grafana-adaptivelogs-app:segments-admin`	Create and manipulate segments
`plugins:grafana-adaptivelogs-app:expiring-exemptions-user`	Use the expiring exemptions button
`plugins:grafana-adaptivelogs-app:plugin-access`	Access to the Adaptive Logs plugin

Adaptive Metrics plugin

Plugin ID: grafana-adaptive-metrics-app

Plugin role	Description
`plugins:grafana-adaptive-metrics-app:admin`	Read/write access to everything in Adaptive Metrics
`plugins:grafana-adaptive-metrics-app:rules-editor`	Read/write access to recommendations and rules
`plugins:grafana-adaptive-metrics-app:rules-reader`	Read access to recommendations and rules
`plugins:grafana-adaptive-metrics-app:exemptions-editor`	Edit access to recommendation exemptions
`plugins:grafana-adaptive-metrics-app:exemptions-reader`	Read access to recommendation exemptions
`plugins:grafana-adaptive-metrics-app:segments-editor`	Edit access to segments
`plugins:grafana-adaptive-metrics-app:segments-reader`	Read access to segments
`plugins:grafana-adaptive-metrics-app:config-editor`	Edit access to plugin configuration
`plugins:grafana-adaptive-metrics-app:config-reader`	Read access to plugin configuration
`plugins:grafana-adaptive-metrics-app:plugin-access`	Access to the Adaptive Metrics plugin

Adaptive Traces plugin

Plugin ID: grafana-adaptivetraces-app

Plugin role	Description
`plugins:grafana-adaptivetraces-app:admin`	Read/write access to everything in Adaptive Traces

Application Observability plugin

Plugin ID: grafana-app-observability-app

Plugin role	Description
`plugins:grafana-app-observability-app:admin`	Read/write access to everything in Application Observability plugin
`plugins:grafana-app-observability-app:viewer`	View access in Application Observability plugin

Cloud Provider plugin

Plugin ID: grafana-csp-app

Plugin role	Description
`plugins:grafana-csp-app:aws-writer`	Read/Write access to AWS in Cloud provider plugin
`plugins:grafana-csp-app:azure-writer`	Read/Write access to Azure in Cloud provider plugin
`plugins:grafana-csp-app:gcp-writer`	Read/Write access to GCP in Cloud provider plugin
`plugins:grafana-csp-app:reader`	Read access in Cloud provider plugin

Cost Attributions plugin

Plugin ID: grafana-attributions-app

Plugin role	Description
`plugins:grafana-attributions-app:cost-attributions-viewer`	View the Cost Attributions application and its data

Cost Management and Billing plugin

Plugin ID: grafana-cmab-app

Plugin role	Description
`plugins:grafana-cmab-app:full-admin`	Full access to all features
`plugins:grafana-cmab-app:billing-and-usage-reader`	Read-only access to billing and usage data
`plugins:grafana-cmab-app:invoice-reader`	Read-only access to invoices, FOCUS & usage data
`plugins:grafana-cmab-app:cost-attribution-admin`	Full access to cost attributions
`plugins:grafana-cmab-app:cost-attribution-reader`	Read-only access to cost attributions
`plugins:grafana-cmab-app:usage-alerts-admin`	Full access to usage alerts
`plugins:grafana-cmab-app:usage-alerts-reader`	Read-only access to usage alerts

Easystart / Integrations plugin

Plugin ID: grafana-easystart-app

Plugin role	Description
`plugins:grafana-easystart-app:integrations-writer`	Administer integrations

Fleet Management (Collector plugin)

Plugin ID: grafana-collector-app

Plugin role	Description
`plugins:grafana-collector-app:collector-app-admin`	Full access to Fleet Management
`plugins:grafana-collector-app:collector-app-reader`	Read-only access to Fleet Management

Frontend Observability plugin

Plugin ID: grafana-kowalski-app

Plugin role	Description
`plugins:grafana-kowalski-app:frontend-observability-admin`	Read/write access to everything in Frontend Observability plugin
`plugins:grafana-kowalski-app:frontend-observability-editor`	Read/write access to everything but app deletion
`plugins:grafana-kowalski-app:frontend-observability-viewer`	View access only
`plugins:grafana-kowalski-app:frontend-observability-sourcemap-uploader`	View access with the ability to read settings and upload sourcemaps

Grafana Assistant plugin

Plugin ID: grafana-assistant-app

Plugin role	Description
`plugins:grafana-assistant-app:assistant-admin`	Manage both user and tenant-wide Assistant resources and settings
`plugins:grafana-assistant-app:assistant-mcp-user`	Use Grafana Assistant and add personal MCP servers
`plugins:grafana-assistant-app:assistant-user`	Basic access to Grafana Assistant with read-only capabilities
`plugins:grafana-assistant-app:assistant-investigation-user`	Use Assistant Backend Investigations

Grafana Auth plugin

Plugin ID: grafana-auth-app

Plugin role	Description
`plugins:grafana-auth-app:writer`	Write and manage access policies for Grafana Cloud

Incident plugin

Plugin ID: grafana-incident-app

Plugin role	Description
`plugins:grafana-incident-app:incident-access`	Access to Grafana Incident

IRM plugin

Plugin ID: grafana-irm-app

Core roles

Plugin role	Description
`plugins:grafana-irm-app:admin`	Read/write access to everything in IRM
`plugins:grafana-irm-app:editor`	Similar to Admin, minus abilities to: create Integrations, create Escalation Chains, create Outgoing Webhooks, update ChatOps settings, update other user’s settings, and update general IRM settings
`plugins:grafana-irm-app:reader`	Read-only access to everything in IRM
`plugins:grafana-irm-app:oncaller`	Read access to everything in IRM, plus edit access to Alert Groups, Schedules, and own settings
`plugins:grafana-irm-app:notifications-receiver`	Receive alert notifications, plus edit own IRM settings
`plugins:grafana-irm-app:incident-access`	Access to Grafana IRM incidents

Alert groups

Plugin role	Description
`plugins:grafana-irm-app:alert-groups-reader`	Read-only access to Alert Groups
`plugins:grafana-irm-app:alert-groups-editor`	Read access to Alert Groups + ability to act on Alert Groups (acknowledge, resolve, etc)
`plugins:grafana-irm-app:alert-groups-direct-paging`	Manually create new Alert Groups (Direct Paging)

Integrations

Plugin role	Description
`plugins:grafana-irm-app:integrations-reader`	Read-only access to Integrations
`plugins:grafana-irm-app:integrations-editor`	Read/write access to Integrations

Escalation chains

Plugin role	Description
`plugins:grafana-irm-app:escalation-chains-reader`	Read-only access to Escalation Chains
`plugins:grafana-irm-app:escalation-chains-editor`	Read/write access to Escalation Chains

Schedules

Plugin role	Description
`plugins:grafana-irm-app:schedules-reader`	Read-only access to Schedules
`plugins:grafana-irm-app:schedules-editor`	Read/write access to Schedules

ChatOps

Plugin role	Description
`plugins:grafana-irm-app:chatops-reader`	Read-only access to ChatOps settings
`plugins:grafana-irm-app:chatops-editor`	Read/write access to ChatOps settings

Outgoing webhooks

Plugin role	Description
`plugins:grafana-irm-app:outgoing-webhooks-reader`	Read-only access to Outgoing Webhooks
`plugins:grafana-irm-app:outgoing-webhooks-editor`	Read/write access to Outgoing Webhooks

Maintenance

Plugin role	Description
`plugins:grafana-irm-app:maintenance-reader`	Read-only access to Integration Maintenance
`plugins:grafana-irm-app:maintenance-editor`	Read/write access to Integration Maintenance

API keys

Plugin role	Description
`plugins:grafana-irm-app:api-keys-reader`	Read-only access to OnCall API Keys
`plugins:grafana-irm-app:api-keys-editor`	Read/write access to OnCall API Keys + ability to consume the API

User settings

Plugin role	Description
`plugins:grafana-irm-app:user-settings-reader`	Read-only access to own IRM User Settings
`plugins:grafana-irm-app:user-settings-editor`	Read/write access to own IRM User Settings + view basic info about other IRM users
`plugins:grafana-irm-app:user-settings-admin`	Read/write access to your own + other’s IRM User Settings

Notification and general settings

Plugin role	Description
`plugins:grafana-irm-app:notification-settings-reader`	Read-only access to IRM Notification Settings
`plugins:grafana-irm-app:notification-settings-editor`	Read/write access to IRM Notification Settings
`plugins:grafana-irm-app:settings-reader`	Read-only access to IRM Settings
`plugins:grafana-irm-app:settings-editor`	Read/write access to IRM Settings

k6 Cloud plugin

Plugin ID: k6-app

Plugin role	Description
`plugins:k6-app:admin`	Admin access to everything in k6
`plugins:k6-app:editor`	Read/write access to k6 with limited scopes
`plugins:k6-app:reader`	Read-only access to k6

Knowledge Graph plugin

Plugin ID: grafana-asserts-app

Plugin role	Description
`plugins:grafana-asserts-app:knowledge-graph-writer`	Read/write/create in Knowledge Graph
`plugins:grafana-asserts-app:knowledge-graph-reader`	Read-only access to everything in Knowledge Graph
`plugins:grafana-asserts-app:knowledge-graph-access`	Access to Knowledge Graph

Kubernetes Monitoring plugin

Plugin ID: grafana-k8s-app

Plugin role	Description
`plugins:grafana-k8s-app:admin`	Admin access to everything in k8s plugin
`plugins:grafana-k8s-app:reader`	Read-only access to k8s plugin

Labels plugin

Plugin ID: grafana-labels-app

Plugin role	Description
`plugins:grafana-labels-app:labels-writer`	Read/write/create/delete Labels
`plugins:grafana-labels-app:labels-reader`	Read-only access to Labels

Machine Learning plugin

Plugin ID: grafana-ml-app

Plugin role	Description
`plugins:grafana-ml-app:ml-editor`	Read and write access to ML features
`plugins:grafana-ml-app:ml-viewer`	Read access to ML features
`plugins:grafana-ml-app:sift-editor`	Read and write access to Sift features
`plugins:grafana-ml-app:sift-viewer`	Read access to Sift features

OnCall plugin

Plugin ID: grafana-oncall-app

Core roles

Plugin role	Description
`plugins:grafana-oncall-app:admin`	Read/write access to everything in OnCall
`plugins:grafana-oncall-app:editor`	Similar to Admin, minus abilities to: create Integrations, create Escalation Chains, create Outgoing Webhooks, update ChatOps settings, update other user’s settings, and update general OnCall settings
`plugins:grafana-oncall-app:reader`	Read-only access to everything in OnCall
`plugins:grafana-oncall-app:oncaller`	Read access to everything in OnCall, plus edit access to Alert Groups, Schedules, and own settings
`plugins:grafana-oncall-app:notifications-receiver`	Receive OnCall alert notifications, plus edit own OnCall settings

Alert groups

Plugin role	Description
`plugins:grafana-oncall-app:alert-groups-reader`	Read-only access to OnCall Alert Groups
`plugins:grafana-oncall-app:alert-groups-editor`	Read access to OnCall Alert Groups + ability to act on Alert Groups (acknowledge, resolve, etc)
`plugins:grafana-oncall-app:alert-groups-direct-paging`	Manually create new Alert Groups (Direct Paging)

Integrations

Plugin role	Description
`plugins:grafana-oncall-app:integrations-reader`	Read-only access to OnCall Integrations
`plugins:grafana-oncall-app:integrations-editor`	Read/write access to OnCall Integrations

Escalation chains

Plugin role	Description
`plugins:grafana-oncall-app:escalation-chains-reader`	Read-only access to OnCall Escalation Chains
`plugins:grafana-oncall-app:escalation-chains-editor`	Read/write access to OnCall Escalation Chains

Schedules

Plugin role	Description
`plugins:grafana-oncall-app:schedules-reader`	Read-only access to OnCall Schedules
`plugins:grafana-oncall-app:schedules-editor`	Read/write access to OnCall Schedules

ChatOps

Plugin role	Description
`plugins:grafana-oncall-app:chatops-reader`	Read-only access to OnCall ChatOps
`plugins:grafana-oncall-app:chatops-editor`	Read/write access to OnCall ChatOps

Outgoing webhooks

Plugin role	Description
`plugins:grafana-oncall-app:outgoing-webhooks-reader`	Read-only access to OnCall Outgoing Webhooks
`plugins:grafana-oncall-app:outgoing-webhooks-editor`	Read/write access to OnCall Outgoing Webhooks

Maintenance

Plugin role	Description
`plugins:grafana-oncall-app:maintenance-reader`	Read-only access to OnCall Maintenance
`plugins:grafana-oncall-app:maintenance-editor`	Read/write access to OnCall Maintenance

API keys

Plugin role	Description
`plugins:grafana-oncall-app:api-keys-reader`	Read-only access to OnCall API Keys
`plugins:grafana-oncall-app:api-keys-editor`	Read/write access to OnCall API Keys + ability to consume the API

User settings

Plugin role	Description
`plugins:grafana-oncall-app:user-settings-reader`	Read-only access to own OnCall User Settings
`plugins:grafana-oncall-app:user-settings-editor`	Read/write access to own OnCall User Settings + view basic info about other OnCall users
`plugins:grafana-oncall-app:user-settings-admin`	Read/write access to your own + other’s OnCall User Settings

Notification and general settings

Plugin role	Description
`plugins:grafana-oncall-app:notification-settings-reader`	Read-only access to OnCall Notification Settings
`plugins:grafana-oncall-app:notification-settings-editor`	Read/write access to OnCall Notification Settings
`plugins:grafana-oncall-app:settings-reader`	Read-only access to OnCall Settings
`plugins:grafana-oncall-app:settings-editor`	Read/write access to OnCall Settings

Private Data Connect plugin

Plugin ID: grafana-pdc-app

Plugin role	Description
`plugins:grafana-pdc-app:private-networks-read`	Read Private Networks
`plugins:grafana-pdc-app:private-networks-write`	Edit Private Networks

SLO plugin

Plugin ID: grafana-slo-app

Plugin role	Description
`plugins:grafana-slo-app:slo-reader`	View SLOs in folders where you have folder read permission
`plugins:grafana-slo-app:slo-writer`	Manage SLOs in folders where you have folder edit permission
`plugins:grafana-slo-app:slo-admin`	SLO Writer, plus the ability to modify org preferences

Synthetic Monitoring plugin

Plugin ID: grafana-synthetic-monitoring-app

Core roles

Plugin role	Description
`plugins:grafana-synthetic-monitoring-app:admin`	Full access to write and manage checks, probes, alerts, thresholds, and access tokens as well as enabling/disabling the plugin
`plugins:grafana-synthetic-monitoring-app:editor`	Add, update and delete checks, probes, alerts, and thresholds
`plugins:grafana-synthetic-monitoring-app:reader`	Read checks, probes, alerts, thresholds, and access tokens

Granular roles

Plugin role	Description
`plugins:grafana-synthetic-monitoring-app:checks-reader`	Read checks
`plugins:grafana-synthetic-monitoring-app:checks-writer`	Create, edit and delete checks
`plugins:grafana-synthetic-monitoring-app:probes-reader`	Read probes
`plugins:grafana-synthetic-monitoring-app:probes-writer`	Create, edit and delete probes
`plugins:grafana-synthetic-monitoring-app:alerts-reader`	Read alerts
`plugins:grafana-synthetic-monitoring-app:alerts-writer`	Create, edit and delete alerts
`plugins:grafana-synthetic-monitoring-app:thresholds-reader`	Read thresholds
`plugins:grafana-synthetic-monitoring-app:thresholds-writer`	Read and edit thresholds
`plugins:grafana-synthetic-monitoring-app:access-tokens-writer`	Create and delete access tokens

Role assignment

Plugin roles can be assigned to:

Users: Individual user accounts
Teams: All members of a team inherit the role
Basic Roles: Can be added to Viewer, Editor, or Admin base roles

To assign roles, use:

UI: Administration > Users/Teams > Select user/team > Roles tab
API: PUT /api/access-control/users/{userId}/roles or PUT /api/access-control/teams/{teamId}/roles

For more information about managing RBAC roles, refer to Manage RBAC roles.

Query plugin roles

You can query your Grafana Cloud stack’s available plugin roles using the API:

curl -s -H "Authorization: Bearer YOUR_SERVICE_ACCOUNT_TOKEN" \
  "https://YOUR_STACK.grafana.net/api/access-control/roles?includeHidden=true" | \
  jq '[.[] | select(.name | startswith("plugins:"))]'

RBAC for app plugins: Overview of how RBAC works with app plugins
Folder access control: How folders interact with plugin roles
RBAC fixed role definitions: Fixed roles for Grafana features
Manage RBAC roles: How to manage role assignments

Troubleshooting RBAC

Fri, 03 Apr 2026 19:43:06 +0000

Troubleshooting RBAC

In this section, you’ll learn about logs that are available for RBAC and you’ll find the most common RBAC issues.

Enable debug logging

You can enable debug log messages for RBAC in the Grafana configuration file. Debug logs are added to the Grafana server logs.

[log]
filters = accesscontrol:debug accesscontrol.evaluator:debug dashboard.permissions:debug

Enable audit logging

Note
Available in Grafana Enterprise and Grafana Cloud.

You can enable auditing in the Grafana configuration file.

[auditing]
enabled = true

All permission and role updates, and role assignments are added to audit logs. Learn more about access control audit logs.

Missing dashboard, folder or data source permissions

Dashboard and folder permissions and data source permissions can go out of sync if a Grafana instance version is upgraded, downgraded and then upgraded again. This happens when an instance is downgraded from a version that uses RBAC to a version that uses the legacy access control, and dashboard, folder or data source permissions are updated. These permission updates will not be applied to RBAC, so permissions will be out of sync when the instance is next upgraded to a version with RBAC.

Note
the steps provided below will set all dashboard, folder and data source permissions to what they are set to with the legacy access control. If you have made dashboard, folder or data source permission updates with RBAC enabled, these updates will be wiped.

To resynchronize the permissions:

make a backup of your database

run the following SQL queries

DELETE
FROM builtin_role
where role_id IN (SELECT id
                  FROM role
                  WHERE name LIKE 'managed:%');
DELETE
FROM team_role
where role_id IN (SELECT id
                  FROM role
                  WHERE name LIKE 'managed:%');
DELETE
FROM user_role
where role_id IN (SELECT id
                  FROM role
                  WHERE name LIKE 'managed:%');
DELETE
FROM permission
where role_id IN (SELECT id
                  FROM role
                  WHERE name LIKE 'managed:%');
DELETE
FROM role
WHERE name LIKE 'managed:%';
DELETE
FROM migration_log
WHERE migration_id IN ('teams permissions migration',
                       'dashboard permissions',
                       'dashboard permissions uid scopes',
                       'data source permissions',
                       'data source uid permissions',
                       'managed permissions migration',
                       'managed folder permissions alert actions repeated migration',
                       'managed permissions migration enterprise');

restart your Grafana instance