How to give external tenant users reader-access to azure managed Grafana instance in another tenant?

Hello Mahmoodi, Somayeh (Admin)

Here's a step-by-step approach to help you achieve this:

1.Adding External Users: You can invite external users as guests in your Microsoft Entra ID. To do so:

• In the Azure portal, navigate to Microsoft Entra ID.
• Go to Users > New user > Invite external user.
• Enter the external user's email address and assign any necessary roles.

2.Assigning Roles: After the external users accept the invite:

• Go to your Azure Managed Grafana instance.
• Open Access Control (IAM) and assign them the Grafana Viewer or Grafana Reader role.

3.Access URL: Share the Grafana URL (e.g., https://your-instance.grafana.azure.com) with the external users. They will log in using their own credentials.

Regarding the use of a B2C tenant, Azure Managed Grafana requires users to authenticate using Microsoft Entra IDs. Unfortunately, external users cannot log in via B2C without some specific configurations in your environment. Azure Managed Grafana does not support non-Entra ID accounts, meaning that if you're strictly limited to B2C, users won’t be able to access Grafana without an Entra ID account.

Key Considerations:

• App Registration: Registering an app in the external tenant is typically unnecessary unless you are creating a custom OAuth flow, which isn't common for this setup.
• Cross-tenant Authentication: If you must allow access via B2C, you’ll likely face significant authorization hurdles, and it’s generally not the recommended path for Grafana.

Hope this helps! If you have further questions or need clarification on specific points, feel free to ask!

References:

• Add a guest user
• Manage access and permissions for users and identities
• Configure Azure Managed Grafana authentication and permissions
• Known Limitations of Azure Managed Grafana
• Monitor your Azure resources

Thank you.

thank you for your reply. For a reason, I need to use B2C tenant instead of B2B.

Hello Mahmoodi, Somayeh (Admin)

As I recall the cleanest way is to just invite the external users as guest (B2B) users into your tenant through Entra ID → Users → New guest user. Once they accept the invite, you can go to your Azure Managed Grafana instance, open Access control (IAM), and assign them the Grafana Viewer or Grafana Reader role.

They’ll then be able to sign in using their own credentials from their home tenant, and Azure handles the cross-tenant authentication automatically. The Grafana endpoint (for example, https://your-instance.grafana.azure.com) stays the same — no special redirect URI or separate app registration needed.

You only need to register an app in the external tenant if you want a fully separate OAuth flow (which isn’t typical for Azure Managed Grafana).

So in short: → Invite external users as guests → Assign them the Grafana role in IAM → Share the Grafana URL — they’ll log in normally

That should work fine.

If you have any questions please let me know.

Thank you.

thank you for your response. I made some research that I like to share the results. First, Azure Managed Grafana (AMG) can't be multi-tenant. So, if the authentication needs to be done in External tenant, Grafana instance should be created there and our internal users should use their non-company ID's to access the instance, like external users. AMG also can't support custom domain directly. question: Can I use custom domain with AMG as discussed in https://learn.microsoft.com/en-us/entra/external-id/customers/concept-custom-url-domain and having authentication/authorization using Entra External? Second, do I need to register an app for this scenario? Third, do I have to have Azure Front door for reverse proxy? Is there a cheaper option for it? I appreciate any help on this.