Set up Azure Managed Grafana authentication and permissions

Sign in to the Azure portal with your Azure account.

Open your CLI and run the az login command to sign in to Azure.

az login

This command will prompt your web browser to launch and load an Azure sign-in page.

Configure basic settings

1. In the upper-left corner of the home page, select Create a resource. In the Search resources, services, and docs (G+/) box, enter Azure Managed Grafana and select Azure Managed Grafana.

   

2. Select Create.

3. In the Basics pane, enter the following settings.

   Setting	Description	Example
   Subscription ID	Select the Azure subscription you want to use.	my-subscription
   Resource group name	Create a resource group for your Azure Managed Grafana resources.	my-resource-group
   Location	Use Location to specify the geographic location in which to host your resource. Choose the location closest to you.	(US) East US
   Name	Enter a unique resource name. It will be used as the domain name in your Managed Grafana instance URL.	my-grafana
   Pricing Plan	Choose between an Essential (preview) and a Standard plan. The Standard tier offers additional features. More information about pricing plans.	Essential (preview)

4. Keep all other default values and select the tab Permission to control access rights for your Grafana instance and data sources:

Configure permission settings

Review below different methods to manage permissions to access data sources within Azure Managed Grafana.

With managed identity enabled

System-assigned managed identity is the default authentication method provided to all users who have the Owner or User Access Administrator role for the subscription.

1. The box System assigned managed identity is set to On by default.

2. The box Add role assignment to this identity with 'Monitoring Reader' role on target subscription is checked by default. If you uncheck this box, you will need to manually add role assignments for Azure Managed Grafana later on. For reference, go to Modify access permissions to Azure Monitor.

3. Under Grafana administrator role, the box Include myself is checked by default. Optionally select Add to grant the Grafana administrator role to more members.

   

With managed identity disabled

Azure Managed Grafana can also access data sources with managed identity disabled. You can use a service principal for authentication, using a client ID and secret.

1. In the Permissions tab, set the box System assigned managed identity to Off. The line Add role assignment to this identity with 'Monitoring Reader' role on target subscription is automatically grayed out.

2. Under Grafana administrator role, if you have the Owner or User Access Administrator role for the subscription, the box Include myself is checked by default. Optionally select Add to grant the Grafana administrator role to more members. If you don't have the necessary role, you won't be able to manage Grafana access rights yourself.

   

Review and create the new instance

Select the Review + create tab. After validation runs, select Create. Your Azure Managed Grafana resource is deploying.

Run the az group create command below to create a resource group to organize the Azure resources needed. Skip this step if you already have a resource group you want to use.

az group create --location <location> --name <resource-group-name>

With managed identity enabled

System-assigned managed identity is the default authentication method for Azure Managed Grafana. Run the az grafana create command below to create an Azure Managed Grafana instance with system-assigned managed identity.

1. If you have the owner or administrator role on this subscription:

   Parameter	Description	Example
   --name	Choose a unique name for your new Managed Grafana instance.	grafana-test
   --resource-group	Choose a resource group for your Managed Grafana instance.	my-resource-group

   az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name>
   

2. If you don't have the owner or administrator role on this subscription:

   Parameter	Description	Example
   --name	Choose a unique name for your new Managed Grafana instance.	grafana-test
   --resource-group	Choose a resource group for your Managed Grafana instance.	my-resource-group
   --skip-role-assignment	Enter true to skip role assignment if you don't have an owner or administrator role on this subscription. Skipping role assignment lets you create an instance without the roles required to assign permissions.	--skip-role-assignment true

   az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name> --skip-role-assignment true
   

With managed identity disabled

Azure Managed Grafana can also access data sources with managed identity disabled. You can use a service principal for authentication, using a client ID and secret instead of a managed identity. To use this method, run the command below:

az grafana create --name <managed-grafana-resource-name> --resource-group <resource-group-name> --skip-role-assignment true --skip-system-assigned-identity true

Once the deployment is complete, you'll see a note in the output of the command line stating that the instance was successfully created, alongside with additional information about the deployment.