---
title: Setting up Entra ID authentication in Grafana
slug: how-tos/HrYB-azure-entra-id-authentication-in-grafana
createdAt: 2025-08-13T11:53:18.534Z
---

## Requirements

Before configuring authentication with Entra ID, make sure you have:

- Grafana version 11.2 or newer.
- An **Entra ID App registration** for Grafana. If you have not done this yet, please first [register an app in Entra ID](docId\:y7NflUbTgVhBFaHpGvCBe).
  - You’ll need the following details from the registration:
    - **Client ID**
    - **Tenant ID**
    - **Client secret**
- A **fully qualified Grafana root URL**, starting with `https://` (no IP address or `localhost`).
- Admin privileges in both **Grafana** and **Microsoft Entra ID**.

## Configure authentication

In Grafana, go to **Administration > Authentication > Azure AD**.

### Step 1: Add Client ID and Client Secret

Copy the **Client ID** and **Client Secret** from your [App registration](docId\:y7NflUbTgVhBFaHpGvCBe) and paste them in Grafana authentication configuration.

### Step 2: Add Scopes, Auth URL and Token URL

- **Scopes**: `openid`, `email`, `profile`
- **Auth URL**: `https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize`
  - e.g. `https://login.microsoftonline.com/12345678-abcd-4321-efgh-9876543210ab/oauth2/v2.0/authorize`
- **Token URL:&#x20;**`https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token`
  - e.g. `https://login.microsoftonline.com/12345678-abcd-4321-efgh-9876543210ab/oauth2/v2.0/token`

**Note:** Replace `<TENANT_ID>` with your Azure Tenant ID.

### Step 3: Enable Sign up and Auto login

- **Allow sign up** creates a Grafana user when logging in the first time.
- **Auto login** skips the Grafana login page and redirects directly to Entra AD login.

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-geyRalRLkE_lzFiOyaLuO-20250819-090533.png)

## Configure Group mapping

You can map Entra AD users to Grafana roles in two ways:

:::hint{type="info"}
When group mapping is enabled, a user in Grafana can not be manually configured into a user group, since on each login the user will be linked to the user groups matching in Microsoft Entra ID. To manually assign users to groups in Grafana, skip this section.
:::

### Option 1: Map Microsoft Entra security groups

- In Entra AD, find the Security Group and copy its **Object ID**.

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-3Ne5XCvLfLlqChrQYTjCd-20250819-095939.png)

- In Grafana, go to **Administration > Authentication > Azure AD > User Mapping**.
- Add mapping in the format: `<AZURE-GROUP-OBJECT-ID>:<GRAFANA-ORG-ID>:<GRAFANA-ROLE>`
- Example:
  - 488f1647-xxxx-xxxx-xxxx-7994b4f022f5:1\:Viewer
  - 5343xde2-xxxx-xxxx-xxxx-7994b4f022f5:1\:Editor

:::hint{type="info"}
For more info, please review [the Grafana docs](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/azuread/).
:::

### Option 2: Map Azure App roles

- Define an App Role for each Grafana role in Entra ID.
  - Admin
  - Editor
  - Viewer
  - Grafana Admin
    - To be able to map the Grafana Admin role, the setting **Allow assign Grafana admin** needs to be enabled. This setting is located immediately underneath the **Organization mapping** field.
- Assign an App role to a security group (to apply to all users in that security group) or to a user to grant the user(s) a role in Grafana.
- In Grafana, add mapping in `Organization mapping` section in the format: `<AZURE-APP-ROLE-VALUE>:<GRAFANA-ORG-ID>:<GRAFANA-ROLE>`
- Example:
  - grafana-viewer:1\:Viewer
  - grafana-editor:1\:Editor
  - grafana-admin:1\:Admin
  - grafana-server-admin:1\:GrafanaAdmin

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-sJ79jwOaTpD4CVfSIjsN4-20250819-090850.png)

## Test authentication and group mapping

In Grafana, first log out as the Server Admin user. Next, log in with a user that is part of a mapped Security group or App role via Entra ID.

- **Case 1**: Works
  - User logs in successfully and gets the right Grafana role. 🎉
- **Case 2**: Error “You don’t have access to any resources”
  - Problem: Authentication works, but **no role mapping** was applied.
  - Solution: Check your group or role mappings.
- **Case 3**: Other errors
  - Problem: **Authentication fails**.
  - Solution: See [Troubleshooting](docId\:HrYBCUQsEZVwUMwdjOeW1) section below.

## Troubleshooting

- [Troubleshooting Entra ID Authentication](docId\:qOg3bRlwI2HFPDLojGFXm)

## FAQ

### Can users be part of multiple mappings?

All lines that match the user in `Organization mapping`will be applied. This means a user can be assigned multiple roles in the same Grafana organization (highest role wins), or have a separate role in another Grafana organization.

### Can users get a default role without mapping?

In Grafana, the setting `role_attribute_path` in file `/etc/grafana/grafana.ini` on the server can be used to set an expression to apply a default role to any user. Or alternatively, a role can be manually assigned to a user in Grafana. As long as no group mappings are added, the manually assigned roles will stay put.