Azure AD OAuth2 authentication

    To enable the Azure AD OAuth2, register your application with Azure AD.

    1. Log in to , then click Azure Active Directory in the side menu.

    2. If you have access to more than one tenant, select your account in the upper right. Set your session to the Azure AD tenant you wish to use.

    3. Under Manage in the side menu, click App Registrations > New Registration. Enter a descriptive name.

    4. Under Redirect URI, select the app type Web.

    5. Add the following redirect URLs and https://<grafana domain> then click Register. The app’s Overview page opens.

      • Note the OAuth 2.0 authorization endpoint (v2) URL. This is the authorization URL.
      • Note the OAuth 2.0 token endpoint (v2). This is the token URL.

    7. Click Certificates & secrets, then add a new entry under Client secrets with the following configuration.

      • Description: Grafana OAuth
      • Expires: Never

    8. Click Add then copy the key value. This is the OAuth client secret.

    9. Click Manifest, then define the required Application Role values for Grafana: Viewer, Editor, or Admin. If not defined, all users will have the Viewer role. Every role requires a unique ID which you can generate on Linux with uuidgen, and on Windows through Microsoft PowerShell with New-Guid.

    10. Include the unique ID in the configuration file:

    1. Go to Azure Active Directory and then to Enterprise Applications. Search for your application and click on it.

    2. Click on Users and Groups and add Users/Groups to the Grafana roles by using Add User.

    Enable Azure AD OAuth in Grafana

    1. Add the following to the :
    1. name = Azure AD
    2. enabled = true
    4. client_id = APPLICATION_ID
    5. client_secret = CLIENT_SECRET
    6. scopes = openid email profile
    7. auth_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
    8. token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
    9. allowed_domains =

    You can also use these environment variables to configure client_id and client_secret:

    To limit access to authenticated users who are members of one or more groups, set allowed_groups to a comma- or space-separated list of group object IDs. You can find object IDs for a specific group on the Azure portal:

    1. Go to Azure Active Directory -> Groups. If you want to only give access to members of the group example with an ID of 8bab1c86-8fba-33e5-2089-1d1c80ec267d, then set the following:

      1. allowed_groups = 8bab1c86-8fba-33e5-2089-1d1c80ec267d

    The allowed_domains option limits access to users who belong to specific domains. Separate domains with space or comma. For example,

    1. allowed_domains = mycompany.com mycompany.org

    With Team Sync you can map your Azure AD groups to teams in Grafana so that your users will automatically be added to the correct teams.

    You can reference Azure AD groups by group object ID, like .

    To learn more, refer to the documentation.