Set up Azure Managed Grafana authentication and permissions

To process data, Azure Managed Grafana needs permission to access data sources. In this guide, learn how to set up authentication during the creation of the Azure Managed Grafana instance, so that Grafana can access data sources using a system-assigned managed identity or a service principal. This guide also introduces the option to add a Monitoring Reader role assignment on the target subscription.

Prerequisite

An Azure account with an active subscription. Create an account for free.

Sign in to Azure

Sign in to Azure with the Azure portal or with the Azure CLI.

Portal

Sign in to the Azure portal with your Azure account.

Azure CLI

Open your CLI and run the az login command to sign in to Azure.

az login

This command will prompt your web browser to launch and load an Azure sign-in page.

Set up authentication and permissions during the creation of the instance

Create a workspace with the Azure portal or the CLI.

Portal

Configure basic settings

1. In the upper-left corner of the home page, select Create a resource. In the Search resources, services, and docs (G+/) box, enter Azure Managed Grafana and select Azure Managed Grafana.

   

2. Select Create.

3. In the Basics pane, enter the following settings.

   Setting	Description	Example
   Subscription ID	Select the Azure subscription you want to use.	my-subscription
   Resource group name	Create a resource group for your Azure Managed Grafana resources.	my-resource-group
   Location	Use Location to specify the geographic location in which to host your resource. Choose the location closest to you.	(US) East US
   Name	Enter a unique resource name. It will be used as the domain name in your Managed Grafana instance URL.	my-grafana
   Pricing Plan	Choose between an Essential (preview) and a Standard plan. The Standard tier offers additional features. More information about pricing plans.	Essential (preview)

4. Keep all other default values and select the tab Permission to control access rights for your Grafana instance and data sources:

Configure permission settings

Review below different methods to manage permissions to access data sources within Azure Managed Grafana.

With managed identity enabled

System-assigned managed identity is the default authentication method provided to all users who have the Owner or User Access Administrator role for the subscription.

Note

In the permissions tab, if Azure displays the message "You must be a subscription 'Owner' or 'User Access Administrator' to use this feature.", go to the next section of this doc to learn about setting up Azure Managed Grafana with system-assigned managed identity disabled.

1. The box System assigned managed identity is set to On by default.

2. The box Add role assignment to this identity with 'Monitoring Reader' role on target subscription is checked by default. If you uncheck this box, you will need to manually add role assignments for Azure Managed Grafana later on. For reference, go to Modify access permissions to Azure Monitor.

3. Under Grafana administrator role, the box Include myself is checked by default. Optionally select Add to grant the Grafana administrator role to more members.

   

With managed identity disabled

Azure Managed Grafana can also access data sources with managed identity disabled. You can use a service principal for authentication, using a client ID and secret.

1. In the Permissions tab, set the box System assigned managed identity to Off. The line Add role assignment to this identity with 'Monitoring Reader' role on target subscription is automatically grayed out.

2. Under Grafana administrator role, if you have the Owner or User Access Administrator role for the subscription, the box Include myself is checked by default. Optionally select Add to grant the Grafana administrator role to more members. If you don't have the necessary role, you won't be able to manage Grafana access rights yourself.

   

Note

Turning off system-assigned managed identity disables the Azure Monitor data source plugin for your Azure Managed Grafana instance. In this scenario, use a service principal instead of Azure Monitor to access data sources.

Review and create the new instance

Select the Review + create tab. After validation runs, select Create. Your Azure Managed Grafana resource is deploying.

Azure CLI

Run the az group create command below to create a resource group to organize the Azure resources needed. Skip this step if you already have a resource group you want to use.

Parameter	Description	Example
--name	Choose a unique name for your new resource group.	grafana-rg
--location	Choose an Azure region where Managed Grafana is available. For more info, go to Products available by region.	eastus

az group create --location <location> --name <resource-group-name>

Note

The CLI experience for Azure Managed Grafana is part of the amg extension for the Azure CLI (version 2.30.0 or higher). The extension will automatically install the first time you run an az grafana command.

With managed identity enabled

System-assigned managed identity is the default authentication method for Azure Managed Grafana. Run the az grafana create command below to create an Azure Managed Grafana instance with system-assigned managed identity.

1. If you have the owner or administrator role on this subscription:

   Parameter	Description	Example
   --name	Choose a unique name for your new Managed Grafana instance.	grafana-test
   --resource-group	Choose a resource group for your Managed Grafana instance.	my-resource-group

   az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name>
   

2. If you don't have the owner or administrator role on this subscription:

   Parameter	Description	Example
   --name	Choose a unique name for your new Managed Grafana instance.	grafana-test
   --resource-group	Choose a resource group for your Managed Grafana instance.	my-resource-group
   --skip-role-assignment	Enter true to skip role assignment if you don't have an owner or administrator role on this subscription. Skipping role assignment lets you create an instance without the roles required to assign permissions.	--skip-role-assignment true

   az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name> --skip-role-assignment true
   

Note

You must have the owner or administrator role on your subscription to use the system-assigned managed identity authentication method. If you don't have the necessary role, go to the next section to see how to create an Azure Managed Grafana instance with system-assigned managed identity disabled.

With managed identity disabled

Azure Managed Grafana can also access data sources with managed identity disabled. You can use a service principal for authentication, using a client ID and secret instead of a managed identity. To use this method, run the command below:

Parameter	Description	Example
--name	Choose a unique name for your new Managed Grafana instance.	grafana-test
--resource-group	Choose a resource group for your Managed Grafana instance.	my-resource-group
--skip-system-assigned-identity	Enter true to disable system assigned identity. System-assigned managed identity is the default authentication method for Azure Managed Grafana. Use this option if you don't want to use a system-assigned managed identity.	--skip-system-assigned-identity true
--skip-role-assignment	Enter true to skip role assignment if you don't have an owner or administrator role on this subscription. Skipping role assignment lets you create an instance without the roles required to assign permissions.	--skip-role-assignment true

az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name> --skip-role-assignment true --skip-system-assigned-identity true

Note

Turning off system-assigned managed identity disables the Azure Monitor data source plugin for your Azure Managed Grafana instance. In this scenario, use a service principal instead of Azure Monitor to access data sources.

Once the deployment is complete, you'll see a note in the output of the command line stating that the instance was successfully created, alongside with additional information about the deployment.

Update authentication and permissions

After your workspace has been created, you can still turn on or turn off system-assigned managed identity and update Azure role assignments for Azure Managed Grafana.

1. In the Azure portal, from the left menu, under Settings, select Identity.

2. Set the status for System assigned to Off, to deactivate the system assigned managed identity, or set it to On to activate this authentication method.

3. Under permissions, select Azure role assignments to set Azure roles.

4. When done, select Save

   

Note

Disabling a system-assigned managed identity is irreversible. If you re-enable the identity in the future, Azure will create a new identity.

Next steps

Sync Grafana teams with Microsoft Entra groups