Provisioning user and dashboard access (no-admin setup)

Grafana Configuration
1

Hi!
Im trying to accomplish a “no admin” setup with grafana.
I have a complete setup of grafana with provisioning and auth with auto sign in. Authorized users gets signed up and set as viewer.
For my dashboard I also have a good setup which finds the dashboards I have and displays them correctly, as well as data sources. However, when logging in as a viewer I cannot see the dashboard. As a admin, I can see and manage the permissions through the ui for the viewers to see them.

However, my goal here is to have no admin logged in at any time, and thus, I’m wondering how I can set up all authorized users (all viewers) to view all dashboards. The end goal is that everything is configured within the provisioning, .ini file and similar setups, with no admin, curl/http/api commands.

I am looking at maybe giving the custom teams/orgs a chance but I’m worried this will not work for my scenario?

Is there any way that I can provision a dashboard to be viewable to all users, to provision a folder for my dashboards or simply allow all auth viewers to always view the available dashboards without any admin or api commands?

Would appreciate any tips on what grafana.ini configurations that can work, or for a custom group/team, how this setup would look.

And again, the goal is to have it set up so that no admin ever has to log in. This anlso includes not having anny http/api/curl commands to configure anny permissions, I would like a “what you see is what you get” setup, where only what is provisioned and configured in the deployment is accessible, and where authorized users auto sign up and can start viewing the content directly.

Looking forward for any feedback!

2

How can you achieve that? The viewer has a view access by default, so you did something that denied that access.

4

Did you ever figure this out @Giraffen? I’m experiencing the same issue. I have not done anything to explicitly deny access, but after moving my dashboards into folderless git provisioning, all dashboards that are at the “root” level can only be viewed by accounts with Admin access. No one else can even see them. Subfolders are provisioned with the expected permissions though.

5

The important distinction here is that root level dashboards and folder contained dashboards are handled differently. Since your subfolder dashboards are already visible to Viewers, the simplest workaround is to provision the dashboards into a named folder rather than leaving them at the root.

Make sure the folder has View permission for the Viewer organization role. Folder View grants folders:read and dashboards:read, and that permission applies to dashboards in the folder.

Since you’re using Git Sync, provisioned folders are assigned these default permissions automatically: Admin → Admin, Editor → Editor, Viewer → Viewer.
Therefore, for the standard Viewer case, you don’t need to manually configure folder permissions through the UI or API just to make the dashboards viewable.

So the clean setup is: auto-created users → Viewer organization role → Git Synced named folder → dashboards inside that folder. This gives Viewers access without requiring an admin to manually configure each dashboard’s permissions.