Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Documentation Grafana documentation Authentication Azure AD OAuth2 authentication

Azure AD OAuth2 authentication

Only available in Grafana v6.7+

The Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for Grafana. By using Azure AD Application Roles it is also possible to assign Users and Groups to Grafana roles from the Azure Portal.

Create the Azure AD application

To enable the Azure AD OAuth2 you must register your application with Azure AD.

1. Log in to Azure Portal and click Azure Active Directory in the side menu.

2. Click App Registrations and add a new application registration with a fitting name.

3. Click on Authentication then Add a platform and pick Web App.

4. Add the redirect URL https://<grafana domain>/login/azuread.

5. Click Overview and then Endpoints.

   • Note down the OAuth 2.0 authorization endpoint (v2), this will be the auth URL.
   • Note down the OAuth 2.0 token endpoint (v2), this will be the token URL.

6. Close the Endpoints page to come back to the application overview.

7. Note down the “Application ID”, this will be the OAuth client id.

8. Click Certificates & secrets and add a new entry under Client secrets.

   • Description: Grafana OAuth
   • Expires: Never

9. Click Add then copy the key value, this will be the OAuth client secret.

10. Click Manifest.

    • Add definitions for the required Application Roles for Grafana (Viewer, Editor, Admin). Without this configuration all users will be assigned to the Viewer role.

    • Every role has to have a unique id. On Linux this can be created with uuidgen for instance.

      json Copy

      "appRoles": [
      		{
      			"allowedMemberTypes": [
      				"User"
      			],
      			"description": "Grafana admin Users",
      			"displayName": "Grafana Admin",
      			"id": "SOME_UNIQUE_ID",
      			"isEnabled": true,
      			"lang": null,
      			"origin": "Application",
      			"value": "Admin"
      		},
      		{
      			"allowedMemberTypes": [
      				"User"
      			],
      			"description": "Grafana read only Users",
      			"displayName": "Grafana Viewer",
      			"id": "SOME_UNIQUE_ID",
      			"isEnabled": true,
      			"lang": null,
      			"origin": "Application",
      			"value": "Viewer"
      		},
      		{
      			"allowedMemberTypes": [
      				"User"
      			],
      			"description": "Grafana Editor Users",
      			"displayName": "Grafana Editor",
      			"id": "SOME_UNIQUE_ID",
      			"isEnabled": true,
      			"lang": null,
      			"origin": "Application",
      			"value": "Editor"
      		}
      	],

11. Go to Azure Active Directory and then to Enterprise Applications. Search for your application and click on it.

12. Click on Users and Groups and add Users/Groups to the Grafana roles by using Add User.

Enable Azure AD OAuth in Grafana

1. Add the following to the Grafana configuration file:

ini Copy

[auth.azuread]
name = Azure AD
enabled = true
allow_sign_up = true
client_id = APPLICATION_ID
client_secret = CLIENT_SECRET
scopes = openid email profile
auth_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
allowed_domains =
allowed_groups =

Note: Ensure that the root_url in Grafana is set in your Azure Application Reply URLs (App -> Settings -> Reply URLs)

Configure allowed groups and domains

To limit access to authenticated users that are members of one or more groups, set allowed_groups to a comma- or space-separated list of group Object Ids. Object Id for a specific group can be found on the Azure portal: go to Azure Active Directory -> Groups. For instance, if you want to only give access to members of the group example which has Id 8bab1c86-8fba-33e5-2089-1d1c80ec267d, set

ini Copy

allowed_groups = 8bab1c86-8fba-33e5-2089-1d1c80ec267d

You’ll need to ensure that you’ve enabled group attributes in your Azure AD Application Registration manifest file (Azure Portal -> Azure Active Directory -> Application Registrations -> Select Application -> Manifest)

json Copy

"groupMembershipClaims": "ApplicationGroup"

The allowed_domains option limits access to the users belonging to the specific domains. Domains should be separated by space or comma.

ini Copy

allowed_domains = mycompany.com mycompany.org

Team Sync (Enterprise only)

Only available in Grafana Enterprise v6.7+

With Team Sync you can map your Azure AD groups to teams in Grafana so that your users will automatically be added to the correct teams.

Azure AD groups can be referenced by group Object Id, like 8bab1c86-8fba-33e5-2089-1d1c80ec267d.

Learn more about Team Sync