# Grafana Multi-Tenant Discussion

**URL:** <https://community.grafana.com/t/grafana-multi-tenant-discussion/130777>\
**Category:** Configuration\
**Tags:** auth\
**Created:** [September 5, 2024, 4:09pm UTC](https://community.grafana.com/t/grafana-multi-tenant-discussion/130777 "2024-09-05T16:09:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chan1992241](https://avatars.discourse-cdn.com/v4/letter/c/45deac/32.png) [@chan1992241](https://community.grafana.com/u/chan1992241)\
**Post date:** [September 5, 2024, 4:09pm UTC](https://community.grafana.com/t/grafana-multi-tenant-discussion/130777/1 "2024-09-05T16:09:04Z")

</div>

I try to achieve multi tenancy in grafana, something like user-a which only able to get the metric which fall under user-a role, if user-a try to get metric which not under its role, user-a will be forbidden to query the metric.

Does this possible to achieve in grafana, or we have to workaround on its datasources like we need to have multiple prometheus and restrict team or organization to access to that datasource.

---

<div class="post-metadata">

**Author:** ![maxlapshin](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/maxlapshin/32/50630_2.png) [@maxlapshin](https://community.grafana.com/u/maxlapshin)\
**Post date:** [December 13, 2024, 8:04pm UTC](https://community.grafana.com/t/grafana-multi-tenant-discussion/130777/2 "2024-12-13T20:04:15Z")

</div>

It seems that there are several questions to solve:

1. How to obtain some kind of session API key. Maybe auth via oauth central access?
2. How to forward this API key to datasource
3. Prepare datasource so that it will limit all requests to this tenant
4. Do you want to allow to edit dashboards?
5. If yes, then how to update them?

---

<div class="post-metadata">

**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\
**Post date:** [December 13, 2024, 10:26pm UTC](https://community.grafana.com/t/grafana-multi-tenant-discussion/130777/3 "2024-12-13T22:26:29Z")

</div>

Grafana cloud has that.

You will define multiple datasources for the single Promethues with different LBAC

> **[Using label-based access control (LBAC) | Grafana Enterprise Metrics...](https://grafana.com/docs/enterprise-metrics/latest/tenant-management/lbac/)**
>
> Overview Label-based access control can be used to create access policies that will only allow for data to be queried that meets specific label requirements. The feature allows multiple sets of Prometheus label selectors to be associated with a...

Then you will use RBAC to define teams/roles for those datasources:

> **[Grafana Role-based access control (RBAC) | Grafana documentation](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/)**
>
> Role-based access control (RBAC) provides a standardized way of granting, changing, and revoking access so that users can view and modify Grafana resources, such as users and reports.

Keep in mind: LBAC/RBAC are enterprise (paid) features.