Unable to remove user access in Grafana after user has been removed from the Security Group that provided access in Azure Portal IAM,

Question

Unable to remove user access in Grafana after user has been removed from the Security Group that provided access in Azure Portal IAM,

Mike Rees 0 Microsoft Employee

A person on our team left five months ago, internally transferring to another microsoft org (which means the user is still in Entra ID). This user has admin access to our grafana instance, which was because he was in a security group that was provided admin access in IAM in the azure portal. He is no longer in that group, but in Grafana shows as being an Admin.

I try to remove/reduce role, or delete user in grafana and I get a message that I need to do this in the portal in IAM. In the portal, I check this user's access, and I see no access (because he has been removed from the security group). I have no way of removing or reducing this user's access.

This is just one example, there are others (with Viewer roles) that have left our org that I cannot remove their access in Grafana even though they don't show that they have access in Azure portal IAM.

Rahul Jorrigala 4,410 Reputation points Microsoft External Staff Moderator

2025-08-21T18:20:06.5333333+00:00
Hi Mike Rees

Verify IAM Removal: Ensure that the user has indeed been removed from any relevant Azure Security Groups. You mentioned they no longer show access in Azure Portal IAM, which is a good first step.

Permissions Check in Grafana: In the Grafana UI, navigate to the Users section to confirm if the user is still listed there. If they appear, this could just be a display issue, as Grafana may show historical users even if they no longer have access.

Removing Permissions in Grafana:

If the user still appears in Grafana, try to access the Teams section in the Administration panel (if you have the appropriate permissions).

Attempt to remove their access from any teams they might still be a part of.

Potential Sync Delay: Sometimes, changes made in Azure IAM take a bit of time to reflect in Grafana. If you’ve recently removed access, it might just be a matter of waiting for the sync to complete.

Grafana Permissions Structure: Remember that user roles can also be managed at the dashboard and folder levels within Grafana. Make sure to check the permissions at these levels as well.

Recheck Role Assignments: Go back to Azure and double-check the role assignments for this user to ensure there are no lingering permissions. If they're still assigned any roles, you may need to remove these again.

once a user is removed from IAM, Azure no longer sees them as having access, so you can't manage their role from the portal.Grafana still sees them as a user because they logged in previously and were assigned a role.

https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/troubleshooting/

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"
Vinod Pittala 6,395 Reputation points Microsoft External Staff Moderator

2025-08-22T15:02:08.63+00:00

Hi Mike Rees

Just checking in—did the above solution work for you? If you need any further assistance, feel free to let us know. We're always here to help!

If the response was helpful, please consider giving it an upvote. This not only shows appreciation but also helps others in the community find useful solutions more easily.

Thanks !
Mike Rees 0 Reputation points Microsoft Employee

2025-08-22T15:35:35.08+00:00

@Vinod Pittala , NO, it did not work. I have verified that these users are not assigned to any teams. I have verified that they do not have individual access assigned to folders or dashboards.

I have verified that they are not in ANY of the security groups that have been assigned access to Grafana in IAM.

I don't know how long the sync should take. I don't remember exactly when they were removed from the Security groups, but I know it has been a couple of weeks at a minimum, which should be too much time for the sync process.

Another similar issue. This morning I added access for an existing user (one that has used Grafana in the past with editor access). I just assigned Admin role in IAM, and that was about 40 minutes ago. I checked Grafana, and I still see this user as having only 'Editor' role.

The sync does not appear to be working. Unless the sync takes longer than 40 minutes. That would be strange. We have a handful of groups and less than 50 users with access.

Your answer

Rahul Jorrigala 4,410 Reputation points Microsoft External Staff Moderator

2025-08-21T18:20:06.5333333+00:00

Hi Mike Rees

Verify IAM Removal: Ensure that the user has indeed been removed from any relevant Azure Security Groups. You mentioned they no longer show access in Azure Portal IAM, which is a good first step.

Permissions Check in Grafana: In the Grafana UI, navigate to the Users section to confirm if the user is still listed there. If they appear, this could just be a display issue, as Grafana may show historical users even if they no longer have access.

Removing Permissions in Grafana:

If the user still appears in Grafana, try to access the Teams section in the Administration panel (if you have the appropriate permissions).

Attempt to remove their access from any teams they might still be a part of.

Potential Sync Delay: Sometimes, changes made in Azure IAM take a bit of time to reflect in Grafana. If you’ve recently removed access, it might just be a matter of waiting for the sync to complete.

Grafana Permissions Structure: Remember that user roles can also be managed at the dashboard and folder levels within Grafana. Make sure to check the permissions at these levels as well.

Recheck Role Assignments: Go back to Azure and double-check the role assignments for this user to ensure there are no lingering permissions. If they're still assigned any roles, you may need to remove these again.

once a user is removed from IAM, Azure no longer sees them as having access, so you can't manage their role from the portal.Grafana still sees them as a user because they logged in previously and were assigned a role.

https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/troubleshooting/

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"
Vinod Pittala 6,395 Reputation points Microsoft External Staff Moderator

2025-08-22T15:02:08.63+00:00

Hi Mike Rees

Just checking in—did the above solution work for you? If you need any further assistance, feel free to let us know. We're always here to help!

If the response was helpful, please consider giving it an upvote. This not only shows appreciation but also helps others in the community find useful solutions more easily.

Thanks !
Mike Rees 0 Reputation points Microsoft Employee

2025-08-22T15:35:35.08+00:00

@Vinod Pittala , NO, it did not work. I have verified that these users are not assigned to any teams. I have verified that they do not have individual access assigned to folders or dashboards.

I have verified that they are not in ANY of the security groups that have been assigned access to Grafana in IAM.

I don't know how long the sync should take. I don't remember exactly when they were removed from the Security groups, but I know it has been a couple of weeks at a minimum, which should be too much time for the sync process.

Another similar issue. This morning I added access for an existing user (one that has used Grafana in the past with editor access). I just assigned Admin role in IAM, and that was about 40 minutes ago. I checked Grafana, and I still see this user as having only 'Editor' role.

The sync does not appear to be working. Unless the sync takes longer than 40 minutes. That would be strange. We have a handful of groups and less than 50 users with access.

Share via

Unable to remove user access in Grafana after user has been removed from the Security Group that provided access in Azure Portal IAM,

Your answer