Manage user role assignments

Sat, 04 Apr 2026 12:26:57 +0000

Manage user role assignments

There are two ways to assign roles directly to users: in the UI using the role picker, and using the API.

Manage users’ roles within a specific Organization using the role picker

In order to assign roles to a user within a specific Organization using the role picker, you must have a user account with one of the following:

The Admin built-in role.
The Server Admin role.
The fixed role fixed:permissions:writer, assigned for the given Organization.
A custom role with users.roles:add and users.roles:remove permissions.

You must also have the permissions granted by the roles that you want to assign or revoke.

Steps:

Navigate to the Users Configuration page by hovering over Configuration (the gear icon) in the left navigation menu and selecting Users.
Click on the Role column in the row for the user whose role you would like to edit.
Deselect one or more selected roles that you would like to remove from that user.
Select one or more roles that you would like to assign to that user.
Click the Apply button to apply the selected roles to that user.

The user’s permissions will update immediately, and the UI will reflect their new permissions the next time they reload their browser or visit a new page.

Note: The roles that you select will be assigned only within the given Organization. For example, if you grant the user the “Data source editor” role while you are in the main Organization, then that user will be able to edit data source in the main Organization but not in others.

Manage users’ roles in multiple Organizations using the role picker

In order to assign roles across multiple Organizations to a user using the role picker, you must have a user account with one of the following:

The Server Admin built-in role
The fixed role fixed:permissions:writer, assigned globally.
A custom role with users.roles:add and users.roles:remove permissions, assigned globally.

You must also have the permissions granted by the roles that you want to assign or revoke within the Organization in which you’re making changes.

Steps:

Navigate to the Users Admin page by hovering over Server Admin (the shield icon) in the left navigation menu and selecting Users.
Click on a user row to edit that user’s roles.
Under the Organizations header, you will see a list of roles assigned to that user within each of their Organizations. Click on the roles in an organization to open the role picker.
Deselect one or more selected roles that you would like to remove from that user.
Select one or more roles that you would like to assign to that user.
Click the Apply button to apply the selected roles to that user.

The user’s permissions will update immediately, and the UI will reflect their new permissions the next time they reload their browser or visit a new page.

Note: The roles that you select will be assigned only within one Organization. For example, if you grant the user the “Data source editor” role in the row for the main Organization, then that user will be able to edit data source in the main Organization but not in others.

Manage users’ roles via API

To manage user role assignment via API, refer to the fine-grained access control HTTP API docs.

Manage built-in role assignments

Sat, 04 Apr 2026 12:26:57 +0000

Built-in role assignments

To control what your users can access or not, you can assign or unassign Custom roles or Fixed roles to the existing Organization roles or to Grafana Server Admin role. These assignments are called built-in role assignments.

During startup, Grafana will create default assignments for you. When you make any changes to the built-on role assignments, Grafana will take them into account and won’t overwrite during next start.

For more information, refer to Fine-grained access control references.

Manage built-in role assignments

You can create or remove built-in role assignments using Fine-grained access control API or using Grafana Provisioning.

Manage role assignments on Grafana Labs

Manage user role assignments

Manage user role assignments

Manage users’ roles within a specific Organization using the role picker

Manage users’ roles in multiple Organizations using the role picker

Manage users’ roles via API

Manage built-in role assignments

Built-in role assignments

Manage built-in role assignments