Docs: refactored manage users and permissions content (#44343)

* initial refactor * initial draft for teams * restructed topics, added front matter * modified aliases * removes old files * removed files * initial refactor * initial draft for teams * restructed topics, added front matter * modified aliases * removes old files * removed files * final xrefs updates * xref adjustment * copy updates * copy and content updates to about, add to org, add user, admin * copy updates to remove user from org * update org vs server admin section names, cross-link * cross-link add and invite users to org * add remaining cross-links between org and server admin * add dashboard permissions table * add permissions information to teams * add copy invite instructions to invite management * tweaks and link updates * incorporated PM feedback * fixed xrefs * yarn prettier * fix codespell * combined teams and dashboard permissions content Co-authored-by: Mitchel Seaman <mitchel.seaman@gmail.com>
2022-02-15 13:20:45 -06:00
parent d665306ad1
commit 46360ca0c3
56 changed files with 936 additions and 770 deletions
@@ -635,7 +635,7 @@ Path to the default home dashboard. If this value is empty, then Grafana uses St

 Set to `false` to prohibit users from being able to sign up / create
 user accounts. Default is `false`. The admin user can still create
-users from the [Grafana Admin Pages]({{< relref "../manage-users/server-admin/server-admin-manage-users.md" >}}).
+users. For more information about creating a user, refer to [Add a user]({{< relref "../administration/manage-users-and-permissions/manage-server-users/add-user.md" >}}).

 ### allow_org_create

@@ -0,0 +1,13 @@
+++
+title = "Manage users and permissions"
+aliases = ["docs/sources/administration/manage-users-and-permissions/_index.md"]
+weight = 200
+++
+
+# Manage users and permissions
+
+A _user_ is defined as any individual who can log in to Grafana. Each user is associated with a _role_ that includes _permissions_. Permissions determine the tasks a user can perform in the system. For example, the **Admin** role includes permissions for an administrator to create and delete users.
+
+The following topics describe how to use permissions to control user access to data sources, dashboards, users, and teams.
+
+{{< section >}}
@@ -0,0 +1,152 @@
+++
+title = "About users and permissions"
+aliases = ["docs/sources/manage-users/_index.md", "docs/sources/administration/manage-users-and-permissions/about-users-and-permissions.md", "/docs/grafana/latest/permissions/overview/", "docs/sources/permissions/_index.md", "docs/sources/permissions/organization_roles.md"]
+weight = 100
+++
+
+# About users and permissions
+
+A _user_ is defined as any individual who can log in to Grafana. Each user is associated with a _role_ that includes _permissions_. Permissions determine the tasks a user can perform in the system. For example, the **Admin** role includes permissions for an administrator to create and delete users.
+
+You can assign a user one of three types of permissions:
+
+- Grafana server administrator permissions: Manage Grafana server-wide settings and resources
+- Organization permissions: Manage access to dashboards, alerts, plugins, teams, playlists, and other resources for an entire organization. The available roles are Viewer, Editor, and Admin.
+- Dashboard and folder permission: Manage access to dashboards and folders
+
+> **Note**: If you are running Grafana Enterprise, you can also control access to data sources and use fine-grained access control to grant read and write permissions for specific resources. For more information about access control options available with Grafana Enterprise, refer to [Grafana Enterprise user permissions features](#grafana-enterprise-user-permissions-features).
+
+## Grafana server administrators
+
+A Grafana server administrator manages server-wide settings and access to resources such as organizations, users, and licenses. Grafana includes a default server administrator that you can use to manage all of Grafana, or you can divide that responsibility among other server administrators that you create.
+
+A server administrator can perform the following tasks:
+
+- Manage users and permissions
+- Create, edit, and delete organizations
+- View server-wide settings defined in the [Configuration]({{< relref "../../administration/configuration.md" >}}) file
+- View Grafana server statistics, including total users and active sessions
+- Upgrade the server to Grafana Enterprise.
+
+> **Note:** The server administrator role does not exist in Grafana Cloud.
+
+## Organization users and permissions
+
+All Grafana users belong to at least one organization. An organization is an entity that exists within your instance of Grafana.
+
+Permissions assigned to a user within an organization control the extent to which the user has access to and can update the following organization resources:
+
+- dashboards and folders
+- alerts
+- playlists
+- users within that organization
+- data sources
+- teams
+- organization and team settings
+- plugins
+- annotations
+- library panels
+- API keys
+
+### Organization roles
+
+Organization role-based permissions are global, which means that each permission level applies to all Grafana resources within an given organization. For example, an editor can see and update _all_ dashboards in an organization, unless those dashboards have been specifically restricted using [dashboard permissions]({{< relref "manage-dashboard-permissions/_index.md">}}).
+
+Grafana uses the following roles to control user access:
+
+- **Organization administrator**: Has access to all organization resources, including dashboards, users, and teams.
+- **Editor**: Can view and edit dashboards, folders, and playlists.
+- **Viewer**: Can view dashboards and playlists.
+
+The following table lists permissions for each role.
+
+| Permission                     | Organization administrator | Editor | Viewer |
+| :----------------------------- | :------------------------: | :----: | :----: |
+| View dashboards                |             x              |   x    |   x    |
+| Add, edit, delete dashboards   |             x              |   x    |        |
+| Add, edit, delete folders      |             x              |   x    |        |
+| View playlists                 |             x              |   x    |   x    |
+| Add, edit, delete playlists    |             x              |   x    |        |
+| Create library panels          |             x              |   x    |        |
+| View annotations               |             x              |   x    |   x    |
+| Add, edit, delete annotations  |             x              |   x    |        |
+| Access Explore                 |             x              |   x    |        |
+| Add, edit, delete data sources |             x              |        |        |
+| Add and edit users             |             x              |        |        |
+| Add and edit teams             |             x              |        |        |
+| Change organizations settings  |             x              |        |        |
+| Change team settings           |             x              |        |        |
+| Configure application plugins  |             x              |        |        |
+
+## Dashboard permissions
+
+When you want to extend a viewer's ability to edit and save dashboard changes or limit an editor's permission to modify a dashboard, you can assign permissions to dashboards and dashboard folders. For example, you might want a certain viewer to be able to to edit a dashboard. While that user can _see_ all dashboards, you can grant them access to _update_ only one of them.
+
+> Important: The dashboard permissions you specify override the organization permissions you assign to the user for the selected entity.
+
+You can specify the following permissions to dashboards and folders.
+
+- **Admin**: Can create, edit, or delete a dashboard or folder. Administrators can also change dashboard and folder permissions.
+- **Edit**: Can create and edit dashboards. Editors _cannot_ change folder or dashboard permissions, or add, edit, or delete folders.
+- **View**: Can only view dashboards and folders.
+
+For more information about assigning dashboard folder permissions, refer to [Grant dashboard folder permissions]({{< relref "./manage-dashboard-permissions/_index.md#grant-dashboard-folder-permissions" >}}).
+
+For more information about assigning dashboard permissions, refer to [Grant dashboard permissions]({{< relref "./manage-dashboard-permissions/_index.md#grant-dashboard-permissions" >}}).
+
+## Editors with administrator permissions
+
+If you have access to the Grafana server, you can modify the default editor role so that editors can use administrator permissions to manage dashboard folders, dashboards, and teams that they create.
+
+> **Note**: This permission does not allow editors to manage folders, dashboards, and teams that they do not create.
+
+This setting can be used to enable self-organizing teams to administer their own dashboards.
+
+For more information about assigning administrator permissions to editors, refer to [Grant editors administrator permissions]({{< relref "./manage-server-users/grant-editor-admin-permissions.md" >}}).
+
+## Viewers with dashboard preview and Explore permissions
+
+If you have access to the Grafana server, you can modify the default viewer role so that viewers can:
+
+- Edit and preview dashboards, but cannot save their changes or create new dashboards.
+- Access and use [Explore]({{< relref "../../explore/_index.md" >}}).
+
+Extending the viewer role is useful for public Grafana installations where you want anonymous users to be able to edit panels and queries, but not be able to save or create new dashboards.
+
+For more information about assigning dashboard preview permissions to viewers, refer to [Enable viewers to preview dashboards and use Explore]({{< relref "./manage-dashboard-permissions/_index.md#enable-viewers-to-preview-dashboards-and-use-explore" >}}).
+
+## Teams and permissions
+
+A team is a group of users within an organization that have common dashboard and data source permission needs. For example, instead of assigning five users access to the same dashboard, you can create a team that consists of those users and assign dashboard permissions to the team. A user can belong to multiple teams.
+
+You can assign a team member one of the following permissions:
+
+- **Member**: Includes the user as a member of the team. Members do not have team administrator privileges.
+- **Admin**: Administrators have permission to manage various aspects of the team, including team membership, permissions, and settings.
+
+Because teams exist inside an organization, the organization administrator can manage all teams. When the `editors_can_admin` setting is enabled, editors can create teams and manage teams that they create. For more information about the `editors_can_admin` setting, refer to [Grant editors administrator permissions]({{< relref "./manage-server-users/grant-editor-admin-permissions.md" >}}).
+
+## Grafana Enterprise user permissions features
+
+While Grafana OSS includes a robust set of permissions and settings that you can use to manage user access to server and organization resources, you might find that you require additional capabilities.
+
+Grafana Enterprise provides the following permissions-related features:
+
+- Data source permissions
+- Fine-grained access control
+
+### Data source permissions
+
+By default, a user can query any data source in an organization, even if the data source is not linked to the user's dashboards.
+
+Data source permissions enable you to restrict data source query permissions to specific **Users** and **Teams**. For more information about assigning data source permissions, refer to [Data source permissions]({{< relref "../../enterprise/datasource_permissions.md" >}}).
+
+### Fine-grained access control
+
+Fine-grained access control provides you a way of granting, changing, and revoking user read and write access to Grafana resources, such as users, reports, and authentication.
+
+For more information about fine-grained access control, refer to [Fine-grained access control]({{< relref "../../enterprise/access-control" >}}).
+
+### Learn more
+
+Want to know more? Complete the [Create users and teams](https://grafana.com/tutorials/create-users-and-teams) tutorial to learn how to set up users and teams.
@@ -0,0 +1,143 @@
+++
+title = "Manage dashboard permissions"
+aliases = ["/docs/grafana/latest/permissions/dashboard_folder_permissions/", "docs/sources/administration/manage-users-and-permissions/manage-dashboard-permissions/_index.md"]
+weight = 500
+++
+
+# Manage dashboard permissions
+
+Dashboard and dasboard folder permissions enable you to grant a viewer the ability to edit and save dashboard changes, or limit an editor's permission to modify a dashboard.
+
+For more information about dashboard permissions, refer to [Dashboard permissions]({{< relref "../about-users-and-permissions/#dashboard-permissions">}}).
+
+## Grant dashboard folder permissions
+
+When you grant user permissions for folders, that setting applies to all dashboards contained in the folder. Consider using this approach to assigning dashboard permissions when you have users or teams who require access to groups of related dashboards.
+
+### Before you begin
+
+- Ensure you have organization administrator privileges
+- Identify the dashboard folder permissions you want to modify and the users or teams to which you want to grant access. For more information about dashboard permissions, refer to [Dashboard permissions]({{< relref "../about-users-and-permissions/#dashboard-permissions">}}).
+
+**To grant dashboard folder permissions**:
+
+1. Sign in to Grafana as an organization administrator.
+2. In the sidebar, hover your mouse over the **Dashboards** (squares) icon and click **Browse**.
+3. Hover your mouse cursor over a folder and click **Go to folder**.
+4. Click the **Permissions** tab, and then click **Add Permission**.
+5. In the **Add Permission For** dropdown menu, select **User**, **Team**, or one of the role options.
+6. Select the user or team.
+
+   If you select a role option, you do not select a user or team.
+
+7. Select the permission and click **Save**.
+
+## Grant dashboard permissions
+
+When you grant dashboard folder permissions, that setting applies to all dashboards in the folder. For a more granular approach to assigning permissions, you can also assign user permissions to individual dashboards.
+
+For example, if a user with the viewer organization role requires editor (or admin) access to a dashboard, you can assign those elevated permissions on an individual basis.
+
+> **Note**: If you have assigned a user dashboard folder permissions, you cannot also assign the user permission to dashboards contained in the folder.
+
+Grant dashboard permissions when you want to restrict or enhance dashboard access for users who do not have permissions defined in the associated dashboard folder.
+
+### Before you begin
+
+- Ensure you have organization administrator privileges
+- Identify the dashboard permissions you want to modify and the users or teams to which you want to grant access
+
+**To grant dashboard permissions**:
+
+1. Sign in to Grafana as an organization administrator.
+1. In the sidebar, hover your mouse over the **Dashboards** (squares) icon and click **Browse**.
+1. Open a dashboard.
+1. In the top right corner of the dashboard, click **Dashboard settings** (the cog icon).
+1. Click **Permissions** and then click **Add Permission**.
+1. In the **Add Permission For** dropdown menu, select **User** or **Team**.
+1. Select the user or team.
+1. Select the permission and click **Save**.
+
+## Enable viewers to preview dashboards and use Explore
+
+By default, the viewer organization role does not allow viewers to create dashboards or use the Explore feature. However, by modifying a configuration setting you can allow viewers to create and preview (but not save) dashboards, and use the Explore feature.
+
+This modification is useful for public Grafana installations where you want anonymous users to be able to edit panels and queries but not save or create new dashboards.
+
+### Before you begin
+
+- Ensure that you have access to the Grafana server
+
+**To enable viewers to preview dashboards and use Explore**:
+
+1. Open the Grafana configuration file.
+
+   For more information about the Grafana configuration file and its location, refer to [Configuration]({{< relref "../../../administration/configuration">}}).
+
+1. Locate the `viewers_can_edit` parameter.
+1. Set the `viewers_can_edit` value to `true`.
+1. Save your changes and restart Grafana.
+
+## Edit dashboard permissions
+
+Edit dashboard permissions when you are want to enhance or restrict a user's access to a dashboard. For more information about dashboard permissions, refer to [Dashboard permissions]({{< relref "../about-users-and-permissions/#dashboard-permissions">}}).
+
+### Before you begin
+
+- Identify the dashboard and user permission you want to change
+- Ensure you have organization administrator privileges
+
+**To edit dashboard permissions**:
+
+1. Sign in to Grafana as an organization administrator.
+1. In the sidebar, hover your mouse over the **Dashboards** (squares) icon and click **Browse**.
+1. Open a dashboard.
+1. In the top-right corner of the dashboard, click **Dashboard settings** (the cog icon).
+1. Click **Permissions**.
+1. In the dropdown, update the permissions, and click **Save**.
+
+## Restrict access to dashboards
+
+Grafana applies the highest permission a given user has to access a resource like a dashboard, so if you want to prevent a user from accessing a folder or dashboard you need to consider the user's organization role, folder permissions, and dashboard permissions.
+
+- You cannot override organization administrator permissions. Organization administrators have access to all organization resources.
+- User permissions set for a dashboard folder propagate to dashboards contained in the folder.
+- A lower permission level does not affect access if a more general rule exists with a higher permission.
+
+Refer to the following examples to understand how organization and dashboard permissions impact a user's access to dashboards.
+
+### Example 1
+
+In this example, user1 has the editor organization role.
+
+Dashboard permissions settings:
+
+- Everyone with Editor role can edit
+- user1 is set to `view`
+
+Result: User1 has edit permissions because the user's organization role is Editor.
+
+### Example 2
+
+In this example, user1 has the viewer organization role and is a member of team1.
+
+Dashboard permissions settings:
+
+- Everyone with Viewer role can view
+- user1 is set to `edit`
+- team1 is set to `admin`
+
+Result: User1 has administrator permissions for the dashboard because user1 is a member of team1.
+
+### Example 3
+
+In this example, user1 has the viewer organization role.
+
+Dashboard permissions settings:
+
+- user1 is set to `admin`, which is inherited from the permissions set in parent folder
+- user1 is set to `edit`
+
+Result: You receive an error message that cannot override a higher permission with a lower permission in the same dashboard. User1 has administrator permissions.
+
+> Refer to [Fine-grained access Control]({{< relref "../../../enterprise/access-control/_index.md" >}}) in Grafana Enterprise to understand how to use fine-grained permissions to restrict access to dashboards, folders, administrative functions, and other resources.
@@ -0,0 +1,13 @@
+++
+title = "Manage users in an organization"
+aliases = ["docs/sources/manage-users/org-admin/index.md", "docs/sources/administration/manage-users-and-permissions/manage-org-users/_index.md"]
+weight = 400
+++
+
+# Manage users in an organization
+
+Organization administrators can invite users to join their organization. Organization users have access to organization resources based on their role, which is **Admin**, **Editor**, or **Viewer**. Permissions associated with each role determine the tasks a user can perform in the system.
+
+For more information about organization user permissions, refer to [Organization users and permissions]({{< relref "../about-users-and-permissions/#organization-users-and-permissions">}}).
+
+{{< section >}}
@@ -0,0 +1,27 @@
+++
+title = "Change a user's organization permissions"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-org-users/change-user-org-permissions.md"]
+weight = 30
+++
+
+# Change a user's organization permissions
+
+Update user permissions when you want to enhance or restrict a user's access to organization resources. For more information about organization permissions, refer to [Organization roles]({{< relref "../about-users-and-permissions/#organization-roles">}}).
+
+## Before you begin
+
+- Ensure you have organization administrator privileges
+
+**To change the organization role of a user**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Users**.
+1. Find the user account for which you want to change the role.
+
+   If necessary, use the search field to filter the list.
+
+1. Locate the user on the list and in the **Role** column, click the user role.
+1. Select the role that you want to assign.
+1. Click **Update**.
+
+> **Note:** If you have [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can also [change a user's organization permissions]({{< relref "../../manage-users-and-permissions/manage-server-users/change-user-org-permissions.md" >}}) in the Server Admin section.
@@ -0,0 +1,44 @@
+++
+title = "Invite a user to join an organization"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-org-users/invite-user-join-org.md"]
+weight = 10
+++
+
+# Invite a user to join an organization
+
+When you invite users to join an organization, you assign the **Admin**, **Editor**, or **Viewer** role which controls user access to the dashboards and data sources owned by the organization. Users receive an email that prompts them to accept the invitation.
+
+- If you know that the user already has access Grafana and you know their user name, then you issue an invitation by entering their user name.
+- If the user is new to Grafana, then use their email address to issue an invitation. The system automatically creates the user account on first sign in.
+
+> **Note:** If you have [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can also manually [add a user to an organization]({{< relref "../../manage-users-and-permissions/manage-server-users/add-remove-user-to-org.md" >}}).
+
+## Before you begin
+
+- Ensure you have organization administrator privileges.
+- If the user already has access to Grafana, obtain their user name.
+- Determine the permissions you want to assign to the user. For more information about organization permissions, refer to [Organization roles]({{< relref "../about-users-and-permissions/#organization-roles">}}).
+
+**To invite or add an existing user account to your organization**:
+
+1. Sign in to Grafana as an organization administrator.
+1. To switch to the organization to which you want to invite a user, hover your mouse over your profile and click **Switch organization** and select an organization.
+
+   > **Note**: It might be that you are currently in the proper organization and don't need to switch organizations.
+
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Users**.
+1. Click **Invite**.
+1. Enter the following information:
+
+   | Field             | Description                                                                                                                                                                                                                                                              |
+   | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+   | Email or username | Either the email or username that the user will use to sign in to Grafana.                                                                                                                                                                                               |
+   | Name              | The user's name.                                                                                                                                                                                                                                                         |
+   | Role              | Click the organization role to assign this user. For more information about organization roles, refer to [Organization roles]({{< relref "../about-users-and-permissions#organization-roles" >}})..                                                                      |
+   | Send invite email | Switch to on if your organization has configured. The system sends an email to the user inviting them to sign in to Grafana and join the organization. Switch to off if you are not using email. The user can sign in to Grafana with the email or username you entered. |
+
+1. Click **Submit**.
+
+If the invitee is not already a user, the system adds them.
+
+![Invite User](/static/img/docs/manage-users/org-invite-user-7-3.png).
@@ -0,0 +1,31 @@
+++
+title = "Manage a pending invitation"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-org-users/manage-pending-invites.md"]
+weight = 20
+++
+
+# Manage a pending invitation
+
+Periodically review invitations you have sent so that you can see a list of users that have not yet accepted the invitation or cancel a pending invitation.
+
+> **Note:** The **Pending Invites** button is only visible if there are unanswered invitations.
+
+## Before you begin
+
+- Ensure you have organization administrator privileges
+
+**To manage a pending invitation**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Users**.
+1. Click **Pending Invites**.
+
+   The **Pending Invites** button appears only when there are unaccepted invitations.
+
+   ![Pending Invites button](/static/img/docs/manage-users/pending-invites-button-7-3.png)
+
+To cancel an invitation, click the red **X** next to the invitation.
+
+To copy an invitation link and send it directly to a user, click Copy Invite. You can then paste the invite link into a message.
+
+![Pending Invites list](/static/img/docs/manage-users/pending-invites-list-7-3.png)
@@ -0,0 +1,27 @@
+++
+title = "Remove a user from an organization"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-org-users/remove-user-from-org.md"]
+weight = 40
+++
+
+# Remove a user from an organization
+
+You can remove a user from an organization when they no longer require access to the dashboard or data sources owned by the organization. No longer requiring access to an organization might occur when the user has left your company or has internally moved to another organization.
+
+This action does not remove the user account from the Grafana server.
+
+## Before you begin
+
+- Ensure you have organization administrator privileges
+
+**To remove a user from an organization**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Users**.
+1. Find the user account that you want to remove from the organization.
+
+   Use the search field to filter the list, if necessary.
+
+1. Click the red **X** to remove the user from the organization.
+
+> **Note:** If you have [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can also [remove a user from an organization]({{< relref "../../manage-users-and-permissions/manage-server-users/add-remove-user-to-org.md#remove-a-user-from-an-organization" >}}) on the Users page of the Server Admin section.
@@ -0,0 +1,22 @@
+++
+title = "View a list of organization users"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-org-users/view-list-org-users.md"]
+weight = 50
+++
+
+# View a list of organization users
+
+You can see a list of users with accounts in your Grafana organization. If necessary, you can use the search field to filter the list.
+
+## Before you begin
+
+- Ensure you have organization administrator privileges
+
+**To view a list of organization users**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Users**.
+
+![Org Admin user list](/static/img/docs/manage-users/org-user-list-7-3.png)
+
+> **Note:** If you have [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can also [view a global list of users]({{< relref "../../manage-users-and-permissions/manage-server-users/view-list-users.md" >}}) in the Server Admin section of Grafana.
@@ -0,0 +1,17 @@
+++
+title = "Manage users globally"
+aliases = ["docs/sources/manage-users/server-admin/_index.md", "docs/sources/manage-users/server-admin/server-admin-manage-users.md", "docs/sources/administration/manage-users-and-permissions/manage-server-users/_index.md"]
+weight = 300
+++
+
+# Manage users globally
+
+A _user_ is defined as any individual who can log in to Grafana. Each user is associated with a _role_ that includes _permissions_. Permissions determine the tasks a user can perform in the system.
+
+If you have [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions in Grafana, you can manage all users for a Grafana instance in the Server Admin section:
+
+{{< section >}}
+
+If you have [organization administrator]({{< relref "../about-users-and-permissions.md#organization-roles">}}) permissions and _not_ [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, refer to [Manage users in a organization]({{< relref "../../manage-users-and-permissions/manage-org-users/_index.md" >}}).
+
+For more information about users and permissions, refer to [About users and permissions]({{< relref "../about-users-and-permissions">}}).
@@ -0,0 +1,51 @@
+++
+title = "Add or remove a user from an organization"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/add-user-to-org.md"]
+weight = 30
+++
+
+# Add a user to an organization
+
+Add a user to an organization when you want the user to have access to organization resources such as dashboards, data sources, and playlists. A user must belong to at least one organization.
+
+You are required to specify an Admin role for each organization. The first user you add to an organization becomes the Admin by default. After you assign the Admin role to a user, you can add other users to an organization as either Admins, Editors, or Viewers.
+
+## Before you begin
+
+- Add an organization
+- [Add a user]({{< relref "./add-user.md">}}) to Grafana
+- Ensure you have Grafana server administrator privileges
+
+**To add a user to an organization**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. In the **Organizations** section, click **Add user to organization**.
+1. Select an organization and a role.
+
+   For more information about user permissions, refer to [Organization roles]({{< relref "../about-users-and-permissions/#organization-roles">}}).
+
+1. Click **Add to organization**.
+
+The next time the user signs in, they will be able to navigate to their new organization using the Switch Organizations option in the user profile menu.
+
+> **Note:** If you have [organization administrator]({{< relref "../about-users-and-permissions.md#organization-roles">}}) permissions and _not_ [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can still [invite a user to join an organization]({{< relref "../../manage-users-and-permissions/manage-org-users/invite-user-join-org.md" >}}).
+
+# Remove a user from an organization
+
+Remove a user from an organization when they no longer require access to the dashboards, data sources, or alerts in that organization.
+
+## Before you begin
+
+- Ensure you have Grafana server administrator privileges
+
+**To remove a user from an organization**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. In the **Organization** section, click **Remove from organization** next to the organization from which you want to remove the user.
+1. Click **Confirm removal**.
+
+> **Note:** If you have [organization administrator]({{< relref "../about-users-and-permissions.md#organization-roles">}}) permissions and _not_ [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can still [remove a user from an organization]({{< relref "../../manage-users-and-permissions/manage-org-users/remove-user-from-org.md" >}}) in the Users section of organization configuration.
@@ -0,0 +1,28 @@
+++
+title = "Add a user"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/add-user.md"]
+weight = 10
+++
+
+# Add a user
+
+Add users when you want to manually provide individuals with access to Grafana.
+
+When you create a user using this method, you must create their password. The user does not receive a notification by email. To invite a user to Grafana and allow them to create their own password, [invite a user to join an organization]({{< relref "../manage-org-users/invite-user-join-org.md">}}).
+
+When you configure advanced authentication using Oauth, SAML, LDAP, or the Auth proxy, users are created automatically.
+
+## Before you begin
+
+- Ensure that you have Grafana server administrator privileges
+
+**To add a user**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click **New user**.
+1. Complete the fields and click **Create user**.
+
+When you create a user, the system assigns the user viewer permissions in a default organization, which you can change. You can now [add a user to a second organization]({{< relref "./add-remove-user-to-org.md">}}).
+
+> **Note:** If you have [organization administrator]({{< relref "../about-users-and-permissions.md#organization-roles">}}) permissions and _not_ [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can still add users by [inviting a user to join an organization]({{< relref "../../manage-users-and-permissions/manage-org-users/invite-user-join-org.md" >}}).
@@ -0,0 +1,27 @@
+++
+title = "Assign or remove Grafana server administrator privileges"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/assign-remove-server-admin-privileges.md"]
+weight = 20
+++
+
+# Assign or remove Grafana server administrator privileges
+
+Grafana server administrators are responsible for creating users, organizations, and managing permissions. For more information about the server administration role, refer to [Grafana server administrators]({{< relref "../about-users-and-permissions/#grafana-server-administrators">}}).
+
+> **Note:** Server administrators are "super-admins" with full permissions to create, read, update, and delete all resources and users in all organizations, as well as update global settings such as licenses. Only grant this permission to trusted users.
+
+## Before you begin
+
+- [Add a user]({{< relref "./add-user.md">}})
+- Ensure you have Grafana server administrator privileges
+
+**To assign or remove Grafana administrator privileges**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. In the **Grafana Admin** section, click **Change**.
+1. Click **Yes** or **No**, depending on whether or not you want this user to have the Grafana server administrator role.
+1. Click **Change**.
+
+The system updates the user's permission the next time they load a page in Grafana.
@@ -0,0 +1,22 @@
+++
+title = "Change a user's organization permissions"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/change-user-org-permissions.md"]
+weight = 50
+++
+
+# Change a user's organization permissions
+
+Update organization permissions when you want to enhance or restrict a user's access to organization resources. For more information about organization permissions, refer to [Organization roles]({{< relref "../about-users-and-permissions/#organization-roles">}}).
+
+## Before you begin
+
+- [Add a user to an organization]({{< relref "./add-remove-user-to-org.md">}})
+- Ensure you have Grafana server administrator privileges
+
+**To change a user's organization permissions**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. In the **Organizations** section, click the role you want to change, and then select another role.
+1. Click **Update**.
@@ -0,0 +1,24 @@
+++
+title = "Force a user to logout from Grafana"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/force-user-logout.md"]
+weight = 90
+++
+
+# Force a user to log out of Grafana
+
+If you suspect a user account is compromised or is no longer authorized to access the Grafana server, then you can force the user to log out of Grafana.
+
+The force logout action can apply to one device that is logged in to Grafana, or all devices logged in to Grafana.
+
+## Before you begin
+
+- Ensure you have Grafana server administrator privileges
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. Scroll down to the **Sessions** section.
+1. Perform one of the following actions:
+   - Click **Force logout** next to the session entry that you want logged out of Grafana.
+   - Click **Force logout from all devices**.
+1. Confirm the logout.
@@ -0,0 +1,30 @@
+++
+title = "Grant editors administrator permissions"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/grant-editor-admin-permissions.md"]
+weight = 60
+++
+
+# Grant editors administrator permissions
+
+By default, the editor organization role does not allow editors to manage dashboard folders, dashboards, and teams, which you can change by modifying a configuration parameter. You can allow them to do so using the `editors_can_admin` configuration option.
+
+This setting can be used to enable self-organizing teams to administer their own dashboards.
+
+When `editors_can_admin` is enabled:
+
+- Users with the Editor role in an organization are Administrators for new dashboards and folders they create, meaning they can edit dashboard permissions. To learn more about dashboard permissions, refer to [Manage dashboard permissions]({{< relref "../manage-dashboard-permissions/_index.md" >}}).
+- Users with the Editor role in an organization can create teams, and they are Administrators of the teams they create. To learn more about team permissions, refer to [Manage teams]({{< relref "../manage-teams/_index.md" >}})
+
+## Before you begin
+
+- Ensure that you have access to the Grafana server
+
+**To enable editors with administrator permissions**:
+
+1. Log in to the Grafana server and open the Grafana configuration file.
+
+   For more information about the Grafana configuration file and its location, refer to [Configuration]({{< relref "../../../administration/configuration">}}).
+
+1. Locate the `editors_can_admin` parameter.
+1. Set the `editors_can_admin` value to `true`.
+1. Save your changes and restart the Grafana server.
@@ -0,0 +1,68 @@
+++
+title = "View and edit a user account"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/view-user-account-details.md"]
+weight = 110
+++
+
+# View user details
+
+View user details when you want to see login, and organizations and permissions settings associated with a user.
+
+## Before you begin:
+
+- Ensure you have Grafana server administrator privileges
+
+**To view user details**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+
+A user account contains the following sections.
+
+### User information
+
+This section contains basic user information, which users can update.
+
+![Server Admin user information section](/static/img/docs/manage-users/server-admin-user-information-7-3.png)
+
+### Permissions
+
+This indicates whether the user account has the Grafana administrator flag applied. If the flag is set to **Yes**, then the user is a Grafana server administrator.
+
+![Server Admin Permissions section](/static/img/docs/manage-users/server-admin-permissions-7-3.png)
+
+### Organisations
+
+This section lists the organizations the user belongs to and their assigned role.
+
+![Server Admin Organizations section](/static/img/docs/manage-users/server-admin-organisations-7-3.png)
+
+### Sessions
+
+This section includes recent user sessions and information about the time the user logged in and they system they used. You can force logouts, if necessary.
+
+![Server Admin Sessions section](/static/img/docs/manage-users/server-admin-sessions-7-3.png)
+
+# Edit a user account
+
+Edit a user account when you want to modify user login credentials, or delete, disable, or enable a user.
+
+## Before you begin
+
+- Ensure you have Grafana server administrator privileges
+
+**To edit a user account**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+1. Click a user.
+1. Complete any of the following actions, as necessary.
+
+| Action                          | Description                                                                                                                                                     |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Update name, email, or username | **Is the user notified of these changes?**. Click **Save** after you make a change.                                                                             |
+| Change the user's password      | The new password must be at least four characters long. Click **Save** after you make a change.                                                                 |
+| Delete a user                   | This action permanently removes the user from the Grafana server. The user can no longer sign in after you make this change.                                    |
+| Disable user account            | This action prevents a user from signing in with this account, but does not delete the account. You might disable an account if a colleague goes on sabbatical. |
+| Enable a user account           | This action enables a user account.                                                                                                                             |
@@ -0,0 +1,22 @@
+++
+title = "View a list of users"
+aliases = ["docs/sources/administration/manage-users-and-permissions/manage-server-users/view-list-users.md"]
+weight = 100
+++
+
+# View a list of users
+
+You can see a list of users with accounts on your Grafana server. This action might be useful when you want to know which role you assigned to each user.
+
+## Before you begin
+
+- Ensure you have Grafana server administrator privileges
+
+**To view a list of users**:
+
+1. Sign in to Grafana as a server administrator.
+1. Hover your cursor over the **Server Admin** (shield) icon until a menu appears, and click **Users**.
+
+![Server Admin user list](/static/img/docs/manage-users/server-user-list-7-3.png)
+
+> **Note:** If you have [organization administrator]({{< relref "../about-users-and-permissions.md#organization-roles">}}) permissions and _not_ [server administrator]({{< relref "../about-users-and-permissions.md#grafana-server-administrators">}}) permissions, you can still [view of list of users in a given organization]({{< relref "../../manage-users-and-permissions/manage-org-users/view-list-org-users.md" >}}).
@@ -0,0 +1,129 @@
+++
+title = "Manage teams"
+aliases = ["/docs/grafana/latest/manage-users/add-or-remove-user-from-team/","/docs/grafana/latest/manage-users/create-or-remove-team/", "docs/sources/manage-users/manage-teams/index.md", "docs/sources/administration/manage-users-and-permissions/manage-teams/_index.md"]
+weight = 600
+++
+
+# Manage teams
+
+A team is a group of users within an organization that have common dashboard and data source permission needs. For example, instead of assigning five users access to the same dashboard, you can create a team that consists of those users and assign dashboard permissions to the team. A user can belong to multiple teams.
+
+A user can be a Member or an Administrator for a given team. Members of a team inherit permissions from the team, but they cannot edit the team itself. Team Administrators can add members to a team and update its settings, such as the team name, team member's team roles, UI preferences, and home dashboard.
+
+For more information about teams, refer to [Teams and permissions]({{< relref "../about-users-and-permissions/#teams-and-permissions">}}).
+
+## Create a team
+
+A team is a group of users within an organization that have common dashboard and data source permission needs. Use teams to help make user-permission management more efficient.
+
+A user can belong to multiple teams.
+
+### Before you begin
+
+- Ensure that you have either organization administrator permissions or team administrator permissions
+- Make a plan for which users belong to which teams and the permissions team members receive
+
+**To create a team**:
+
+1. Sign in to Grafana as an organization administrator or team administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+1. Click **New Team**.
+1. Complete the fields and click **Create**.
+1. Click **Add member**.
+1. In the **Add team member** field, locate and select a user.
+1. Click **Add to team**.
+
+## Add a team member
+
+Add a team member to an existing team whenever you want to provide access to team dashboards and folders to another user.
+
+### Before you begin
+
+- Ensure that you have organization administrator permissions
+- [Create a team](#create-a-team).
+
+**To add a team member**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+1. Click the name of the team to which you want to add members, and click **Add member**.
+1. In the **Add team member** field, locate and select a user.
+1. Click **Add to team**.
+
+![Add team member](/static/img/docs/manage-users/add-team-member-7-3.png)
+
+## Grant team member permissions
+
+Complete this task when you want to add or modify team member permissions.
+
+### Before you begin
+
+- Ensure that you have either organization administrator permissions or team administrator permissions
+
+**To grant team member permissions**:
+
+1. Sign in to Grafana as an organization administrator or a team administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+1. Click the name of the team for which you want to add or modify team member permissions.
+1. In the team member list, find and click the user account that you want to change. You can use the search field to filter the list if necessary.
+1. Click the **Permission** list, and then click the new user permission level.
+
+![Change team member permissions](/static/img/docs/manage-users/change-team-permissions-7-3.png)
+
+## Remove a team member
+
+You can remove a team member when you no longer want to apply team permissions to the user.
+
+### Before you begin
+
+- Ensure that you have either organization administrator permissions or team administrator permissions
+
+**To remove a team member**:
+
+1. Sign in to Grafana as an organization administrator or team administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+1. Click a team from which you want to remove a user.
+1. Click the **X** next to the name of the user.
+1. Click **Delete**.
+
+## Delete a team
+
+Delete a team when you no longer need it. This action permanently deletes the team and removes all team permissions from dashboards and folders.
+
+### Before you begin
+
+- Ensure that you have organization administrator permissions
+
+**To delete a team**:
+
+1. Sign in to Grafana as an organization administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+1. Click the **X** next to the name of the team.
+1. Click **Delete**.
+
+## View a list of teams
+
+See the complete list of teams in your Grafana organization.
+
+### Before you begin
+
+- Ensure that you have either organization administrator permissions or team administrator permissions
+
+**To view a list of teams**:
+
+1. Sign in to Grafana as an organization administrator or a team administrator.
+1. Hover your cursor over the **Configuration** (gear) icon in the side menu and click **Teams**.
+
+The role you use to sign in to Grafana determines how you see team lists.
+
+**Organization administrator view**
+
+The following example shows a list as it appears to an organization administrator.
+
+![Team list](/static/img/docs/manage-users/org-admin-team-list-7-3.png)
+
+**Team administrator view**
+
+The following example shows a list as it appears to a team administrator.
+
+![Team list](/static/img/docs/manage-users/team-admin-team-list-7-3.png)
@@ -10,9 +10,9 @@ Grafana preferences are basic settings. They control the Grafana UI theme, home

 Preferences are sometimes confusing because they can be set at four different levels, listed from highest level to lowest:

- **Server -** Affects all users on the Grafana server. Set by a [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}).
- **Organization -** Affects all users in an organization. Set by an [Organization Admin]({{< relref "../../permissions/organization_roles.md#organization-admin-role" >}}).
- **Team -** Affects all users assigned to a team. Set by an Organization Admin or Team Admin. To learn more about these roles, refer to [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}).
+- **Server -** Affects all users on the Grafana server. Set by a [Grafana server admin]({{< relref "../manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}).
+- **Organization -** Affects all users in an organization. Set by an [Organization admin]({{< relref "../manage-users-and-permissions/about-users-and-permissions.md#organization-roles" >}}).
+- **Team -** Affects all users assigned to a team. Set by an Organization Admin or Team Admin. To learn more about these roles, refer to [Teams and permissions]({{< relref "../manage-users-and-permissions/about-users-and-permissions.md#teams-and-permissions" >}}).
 - **User account -** Affects the individual user. Set by the user on their own account.

 The lowest level always takes precedence. For example, if a user sets their theme to **Light**, then their visualization of Grafana displays the light theme. Nothing at any higher level can override that.
@@ -40,7 +40,7 @@ Users with the Viewer role can enter _any possible query_ in _any_ of the data s

 To address this vulnerability, you can restrict data source query access in the following ways:

- Create multiple data sources with some restrictions added in data source configuration that restrict access (like database name or credentials). Then use the [Data Source Permissions]({{< relref "../permissions/datasource_permissions.md" >}}) Enterprise feature to restrict user access to the data source in Grafana.
+- Create multiple data sources with some restrictions added in data source configuration that restrict access (like database name or credentials). Then use the [Data Source Permissions]({{< relref "../enterprise/datasource_permissions.md" >}}) Enterprise feature to restrict user access to the data source in Grafana.
 - Create a separate Grafana organization, and in that organization, create a separate data source. Make sure the data source has some option/user/credentials setting that limits access to a subset of the data. Not all data sources have an option to limit access.

 ## Implications of enabling anonymous access to dashboards
@@ -12,7 +12,7 @@ weight = 300

 If you are a Grafana server administrator, use the Settings tab to view the settings that are applied to your Grafana server via the [Configuration]({{< relref "../configuration.md#config-file-locations" >}}) file and any environmental variables.

-> **Note:** Only Grafana server administrators can access the **Server Admin** menu. For more information about about administrative permissions, refer to [Grafana server admin]({{< relref "../../permissions/_index.md" >}}).
+> **Note:** Only Grafana server administrators can access the **Server Admin** menu. For more information about about administrative permissions, refer to [About users and permissions]({{< relref "../manage-users-and-permissions/about-users-and-permissions.md" >}}).

 ## View server settings

@@ -11,7 +11,7 @@ weight = 400

 If you are a Grafana server admin, then you can view useful statistics about your Grafana server in the Stats & Licensing tab.

-> **Note:** Only Grafana server administrators can access the **Server Admin** menu. For more information about about administrative permissions, refer to [Grafana server admin]({{< relref "../../permissions/_index.md" >}}).
+> **Note:** Only Grafana server administrators can access the **Server Admin** menu. For more information about about administrative permissions, refer to [About users and permissions]({{< relref "../manage-users-and-permissions/about-users-and-permissions.md" >}}).

 ## View server stats