Users, teams, organisations and permissions in Grafana

All commands run on graf01 (192.168.56.70) against Grafana on 127.0.0.1:3000 with the admin password from Lesson 2. Keep a private (incognito) browser window ready, so you can log in as the other users without logging admin out.

1Name the organisation and turn on the password policy

Paste this whole block on graf01:

curl -s -u admin:Lab@Grafana2026 -X PUT -H 'Content-Type: application/json' \
  localhost:3000/api/org -d '{"name":"SaatVedha Lab"}'; echo
sudo sed -i '/^\[auth.basic\]/,/^\[/ s/^;password_policy = false/password_policy = true/' /etc/grafana/grafana.ini
sudo grep -A3 '^\[auth.basic\]' /etc/grafana/grafana.ini | grep -v '^#'
sudo systemctl restart grafana-server

You should see:

{"message":"Organization updated"}
[auth.basic]
;enabled = true
password_policy = true

The ;enabled = true line is the commented default that sits in the same section.

The default organisation (ID 1, “Main Org.”) is now called SaatVedha Lab, which is what users see in the profile menu. With the policy on, new and changed passwords must be at least 12 characters with upper case, lower case, a digit and a symbol; existing passwords keep working until they’re changed.

✅ Checkpoint: The API answers Organization updated and grafana.ini shows password_policy = true under [auth.basic].

2Create noc.viewer and ravi.editor

Paste this whole block on graf01:

for u in noc.viewer ravi.editor; do
  curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
    -X POST localhost:3000/api/admin/users \
    -d "{\"name\":\"$u\",\"login\":\"$u\",\"email\":\"$u@lab.local\",\"password\":\"Lab@User2026\",\"OrgId\":1}"
  echo
done
RID=$(curl -s -u admin:Lab@Grafana2026 'localhost:3000/api/users/lookup?loginOrEmail=ravi.editor' | jq .id)
curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X PATCH localhost:3000/api/orgs/1/users/$RID -d '{"role":"Editor"}'; echo
curl -s -u admin:Lab@Grafana2026 localhost:3000/api/org/users | jq -r '.[] | "\(.login)  \(.role)"'

You should see this (your UIDs will differ, and the last three lines can come in another order):

{"id":2,"uid":"df3k2n0q8xla8c","message":"User created"}
{"id":3,"uid":"ef3k2n1b7r4e8d","message":"User created"}
{"message":"Organization user updated"}
admin  Admin
noc.viewer  Viewer
ravi.editor  Editor

New users land in organisation 1 as Viewer, because auto_assign_org_role = Viewer by default, so only ravi.editor needed a change. In a real company you’d set a temporary password and ask users to change it at first login, or let LDAP or single sign-on create them.

✅ Checkpoint: The org user list shows admin Admin, noc.viewer Viewer and ravi.editor Editor.

3Create the NOC team

Paste this whole block on graf01:

TID=$(curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X POST localhost:3000/api/teams -d '{"name":"NOC","email":"noc@lab.local"}' | jq .teamId)
NID=$(curl -s -u admin:Lab@Grafana2026 'localhost:3000/api/users/lookup?loginOrEmail=noc.viewer' | jq .id)
curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X POST localhost:3000/api/teams/$TID/members -d "{\"userId\":$NID}"; echo
curl -s -u admin:Lab@Grafana2026 "localhost:3000/api/teams/$TID/members" | jq -r '.[].login'

You should see:

{"message":"Member added to Team"}
noc.viewer

The same thing in the UI is Administration > Users and access > Teams > New team, then Add member. Teams belong to one organisation, and a user can be in many teams.

✅ Checkpoint: Team NOC exists and lists noc.viewer as a member.

4Build a NOC Wall folder that only the NOC can see

In Grafana create a folder NOC Wall (Dashboards > New > New folder). Move Nginx app01 and Tower routers (SNMP) into it (select them in the dashboard list and click Move). Then open the folder, click Folder actions > Manage permissions and change the list to this:

Now lock the main SaatVedha Lab folder the same way but more loosely: remove Role: Viewer and leave Role: Editor as Edit. From now on, plain viewers see SaatVedha Lab dashboards only if a team grants it.

Run this on graf01 to check what noc.viewer can see:

curl -s -u 'noc.viewer:Lab@User2026' 'localhost:3000/api/search?type=dash-db' \
  | jq -r '.[] | "\(.folderTitle // "General")  /  \(.title)"'

You should see:

NOC Wall  /  Nginx app01
NOC Wall  /  Tower routers (SNMP)

Search only returns what the identity can view, so this is the quickest way to test permissions without clicking through the UI. Log in as noc.viewer in your private window and the dashboard list shows the same two.

✅ Checkpoint: noc.viewer sees only the two NOC Wall dashboards, and ravi.editor (same check with his login) sees NOC Wall plus SaatVedha Lab.

5Create a service account and token for automation

A nightly script will back up dashboards in Lesson 13. It gets its own identity with the Viewer role, never the admin password.

Paste this whole block on graf01:

SAID=$(curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X POST localhost:3000/api/serviceaccounts -d '{"name":"backup-bot","role":"Viewer"}' | jq .id)
curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X POST localhost:3000/api/serviceaccounts/$SAID/tokens \
  -d '{"name":"backup-bot-2026","secondsToLive":7776000}' | jq -r .key > ~/.grafana-backup-token
chmod 600 ~/.grafana-backup-token; cut -c1-10 ~/.grafana-backup-token
curl -s -H "Authorization: Bearer $(cat ~/.grafana-backup-token)" \
  'localhost:3000/api/search?type=dash-db' | jq length

You should see this (your token differs after glsa_):

glsa_x7Kp2
0

The token works (no 401) but finds zero dashboards, because backup-bot is a Viewer and step 4 removed the Viewer role from both folders. Give the service account View on both folders (Manage permissions > Add a permission > Service account: backup-bot, View) and run the last command again: it now counts every dashboard. The token expires in 90 days (7,776,000 seconds), which forces a rotation habit.

✅ Checkpoint: ~/.grafana-backup-token holds a glsa_ token with mode 600, and the search count is above 0 after granting backup-bot View on both folders.

6See what an organisation does

Paste this whole block on graf01:

curl -s -u admin:Lab@Grafana2026 -H 'Content-Type: application/json' \
  -X POST localhost:3000/api/orgs -d '{"name":"Customer Demo"}'; echo
curl -s -u admin:Lab@Grafana2026 -H 'X-Grafana-Org-Id: 2' localhost:3000/api/datasources | jq length
curl -s -u admin:Lab@Grafana2026 -H 'X-Grafana-Org-Id: 1' localhost:3000/api/datasources | jq -r '.[].name'

You should see:

{"message":"Organization created","orgId":2}
0
InfluxDB
Loki
MySQL app01
Prometheus
TestData

The new organisation starts empty: no data sources, no dashboards, no users except the server admin who created it. That isolation is the reason to use one per customer, and also the cost, because every data source and dashboard has to be set up again. Delete it when you’re done with curl -s -u admin:Lab@Grafana2026 -X DELETE localhost:3000/api/orgs/2.

✅ Checkpoint: Customer Demo had 0 data sources while SaatVedha Lab lists five, and the demo organisation is deleted afterwards.

7Snapshot graf01

Run this on your laptop:

VBoxManage snapshot graf01 take users-teams

You should see this (your UUID will differ):

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Snapshot taken. UUID: 9c3e7a10-4d6b-4f28-b17e-5a0c8d2f6e93

✅ Checkpoint: graf01 has a snapshot called users-teams.