Skip to content

Grafana access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Grafana, Black Cat runs 12 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Grafana connector needs.

Checks (12)

severity: high SSO Disabled fix difficulty: medium #

Enable SSO authentication in Grafana to replace password-based login

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Authentication in the left sidebar
  3. Select the desired SSO provider (e.g. Generic OAuth, SAML, GitHub, Google)
  4. Toggle the provider to Enabled and fill in the required client ID, client secret, and endpoint URLs
  5. Optionally set "Disable login form" to true in grafana.ini ([auth] disable_login_form = true) to enforce SSO-only access
  6. Save the configuration and test SSO login from an incognito window before logging out

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Basic Auth Enabled With SSO fix difficulty: easy #

Disable basic authentication when SSO is already configured to eliminate redundant credential vectors

  1. Sign in to Grafana as a Server Admin
  2. Open the grafana.ini configuration file (or set the equivalent environment variable)
  3. Under the [auth] section, set disable_login_form = true
  4. Additionally set [auth.basic] enabled = false to fully disable HTTP basic auth
  5. Restart the Grafana service to apply the changes
  6. Verify that the login page no longer shows a username/password form

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Single SSO Provider fix difficulty: medium #

Configure a secondary SSO provider to ensure authentication redundancy

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Authentication in the left sidebar
  3. Review the currently configured SSO provider
  4. Enable a second SSO provider (e.g. add SAML if OAuth is primary, or configure a backup OAuth app)
  5. Fill in the required client credentials and endpoint URLs for the new provider
  6. Test the secondary provider login flow from an incognito session

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Admins fix difficulty: easy #

Reduce the number of Grafana admin users by reassigning non-administrative users to Editor or Viewer roles

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Users and access in the left sidebar
  3. Filter users by the Server Admin or Org Admin role
  4. For each admin who does not require administrative privileges, click their name to open the user detail page
  5. Change their role to Editor or Viewer as appropriate
  6. Confirm the change and notify the user of their updated permissions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Dormant User fix difficulty: easy #

Deactivate or remove Grafana users who have been inactive for more than 90 days

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Users and access in the left sidebar
  3. Sort or filter users by last login date to identify those inactive for 90+ days
  4. For each dormant user, click their name to open the user detail page
  5. Click "Disable user" to prevent login while preserving audit history, or "Delete user" to fully remove the account
  6. Confirm the action and document the change for audit purposes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Admin Without Recent Activity fix difficulty: easy #

Demote or remove admin accounts that have shown no activity in the last 30 days

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Users and access in the left sidebar
  3. Identify admin users whose last login date exceeds 30 days
  4. Click each inactive admin's name to open their detail page
  5. Downgrade the role to Editor or Viewer, or disable the account if the user is no longer active
  6. Review whether Server Admin privilege is genuinely required for any retained admins

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Service Account Admin Role fix difficulty: easy #

Downgrade service accounts with Admin role to Editor or Viewer to enforce least privilege

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Administration > Service accounts in the left sidebar
  3. Locate the service account flagged with the Admin role
  4. Click the service account name to open its detail page
  5. Change the role to Editor (for dashboard/datasource writes) or Viewer (for read-only access)
  6. Save the change and verify that any dependent integrations still function correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Non-Expiring Service Account Token fix difficulty: easy #

Set expiration dates on all service account tokens to limit credential lifetime

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Administration > Service accounts in the left sidebar
  3. Click the service account that has non-expiring tokens
  4. In the Tokens section, click "Add service account token"
  5. Create a new token with an appropriate expiration date (e.g. 90 days)
  6. Delete the old non-expiring token by clicking the trash icon next to it
  7. Update any integrations that use the old token with the new value

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Disabled Service Account With Tokens fix difficulty: easy #

Delete all tokens from disabled service accounts to prevent credential misuse

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Administration > Service accounts in the left sidebar
  3. Filter or identify service accounts that are disabled
  4. Click the disabled service account to open its detail page
  5. In the Tokens section, click the trash icon next to each token and confirm deletion
  6. Verify that no active tokens remain on the disabled account

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Expired Service Account Token fix difficulty: easy #

Remove expired tokens from service accounts to maintain credential hygiene

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Administration > Service accounts
  3. Click the service account with expired tokens
  4. In the Tokens section, identify and delete expired tokens
  5. If the token is still needed, create a new one with an appropriate expiration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Service Account Token Age Exceeds 180 Days fix difficulty: easy #

Rotate service account tokens older than 180 days to reduce credential exposure risk

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Administration > Service accounts
  3. Click the service account with old tokens
  4. Create a new token with a 90-day expiration
  5. Update all integrations using the old token with the new value
  6. Delete the old token

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Folder Without Custom ACL fix difficulty: easy #

Add a custom access control list to the folder to restrict access beyond organization defaults

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Dashboards > Browse
  3. Locate the folder and click its settings (gear icon)
  4. Open the Permissions tab
  5. Add specific team or user permissions with minimum required roles
  6. Save changes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Grafana checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial