Docs: refactored manage users and permissions content (#44343)

* initial refactor

* initial draft for teams

* restructed topics, added front matter

* modified aliases

* removes old files

* removed files

* initial refactor

* initial draft for teams

* restructed topics, added front matter

* modified aliases

* removes old files

* removed files

* final xrefs updates

* xref adjustment

* copy updates

* copy and content updates to about, add to org, add user, admin

* copy updates to remove user from org

* update org vs server admin section names, cross-link

* cross-link add and invite users to org

* add remaining cross-links between org and server admin

* add dashboard permissions table

* add permissions information to teams

* add copy invite instructions to invite management

* tweaks and link updates

* incorporated PM feedback

* fixed xrefs

* yarn prettier

* fix codespell

* combined teams and dashboard permissions content

Co-authored-by: Mitchel Seaman <mitchel.seaman@gmail.com>
This commit is contained in:
Christopher Moyer
2022-02-15 13:20:45 -06:00
committed by GitHub
co-authored by Mitchel Seaman
parent d665306ad1
commit 46360ca0c3
56 changed files with 936 additions and 770 deletions
-60
View File
@@ -1,60 +0,0 @@
+++
title = "Manage users"
weight = 50
+++
# Manage users
Grafana offers several options for grouping users. Each level has different tools for managing user accounts and different tasks that they can perform.
One of the most important user management tasks is assigning roles, which govern what [permissions]({{< relref "../permissions/_index.md" >}}) a user has. The correct permissions ensure that users have access to only the resources they need.
> Refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) in Grafana Enterprise to understand how you can manage users with fine-grained permissions.
## Server
The highest and broadest level of user group in Grafana is the server. Every user with an account in a Grafana instance is a member of the server group.
Grafana Server Admins are user accounts that have the Grafana Admin option set to **Yes**. They can manage individual user accounts and organizations on their server.
Server Admins can:
- [Manage users]({{< relref "server-admin/server-admin-manage-users.md" >}})
- [Manage organizations]({{< relref "server-admin/server-admin-manage-orgs.md" >}})
## Organization
Organizations are groups of users on a server. Users can belong to one or more organizations, but each user must belong to at least one organization.
Data sources, plugins, and dashboards are associated with organizations. This means that you can have a server with two organizations, one with a Prometheus data source and another with an InfluxDB data source. Each organization has separate data and dashboards.
Members of organizations have permissions based on their _role_ in the organization. For more information, refer to [Organization roles]({{< relref "../permissions/organization_roles.md" >}}).
Organization Admins are user accounts that are assigned the Admin role for an organization. They can manage their users and teams in their organization.
Organization Admins can:
- [Manage users]({{< relref "org-admin/_index.md" >}})
- [Manage teams]({{< relref "manage-teams/index.md" >}})
## Teams
Teams are groups of users within the same organization. Teams allow you to grant permissions for a group of users. They are most often used to manage [permissions for folders and dashboards]({{< relref "../permissions/dashboard-folder-permissions.md" >}}). Enterprise users can use them to apply [data source permissions]({{< relref "../enterprise/datasource_permissions.md" >}}).
Teams are mostly managed by Organization Admins. However, if the Grafana server setting [editors_can_admin]({{< relref "../administration/configuration.md#editors_can_admin" >}}) is applied, then users who are assigned the Team Admin role can also manage teams in their organization and users assigned to their teams.
Team Admins can [Manage teams]({{< relref "manage-teams/index.md" >}}).
## Users
Users are named accounts in Grafana with granted permissions to access resources throughout Grafana. All users can manage their own accounts to a limited extent.
Users can:
- [View and edit user profile]({{< relref "user-admin/user-profile.md" >}})
- [Change password]({{< relref "user-admin/change-your-password.md" >}})
- [Switch organizations]({{< relref "user-admin/switch-org.md" >}})
## Learn more
Set up users and teams in our tutorial on how to [Create users and teams](https://grafana.com/tutorials/create-users-and-teams).
@@ -1,95 +0,0 @@
+++
title = "Manage teams"
aliases =["/docs/grafana/latest/manage-users/add-or-remove-user-from-team/","/docs/grafana/latest/manage-users/create-or-remove-team/"]
weight = 300
+++
# Manage teams
A _team_ is a group of users assigned to an organization on a Grafana server. Each user can belong to more than one organization and more than one team. Teams are generally managed by Organization Admins, but they can also be managed by Editors if the [editors_can_admin]({{< relref "../../administration/configuration.md#editors_can_admin" >}}) server setting is set to `true`. For more information, refer to [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}).
Teams members are assigned one of two permissions:
- Member - Required to be a member of the team.
- Admin - A member of the team that can also manage team membership, change team permissions, change team settings, and add or delete the team.
> **Note:** You must have Organization Admin or Team Admin permissions, or Editor permissions with [editors_can_admin]({{< relref "../../administration/configuration.md#editors_can_admin" >}}) selected, in order to perform the tasks described in this page. Team Admins can only perform tasks that apply to their specific team.
## View team list
See the complete list of teams in your Grafana organization.
{{< docs/shared "manage-users/view-team-list.md" >}}
### Org Admin view
![Team list](/static/img/docs/manage-users/org-admin-team-list-7-3.png)
### Team Admin view
![Team list](/static/img/docs/manage-users/team-admin-team-list-7-3.png)
## Create a team
Add a team to your Grafana organization.
{{< docs/list >}}
{{< docs/shared "manage-users/view-team-list.md" >}}
1. Click **New Team**.
1. Enter team information:
- **Name -** Enter the name of the new team.
- **Email -** (Optional) Enter the team email.
1. Click **Create**.
{{< /docs/list >}}
## Add a team member
Add an existing user account to a team.
{{< docs/list >}}
{{< docs/shared "manage-users/view-team-list.md" >}}
1. Click the name of the team that you want to add users to.
1. Click **Add member**.
1. In the **Add team member** list, click the user account that you want to add to the team. You can also type in the field to filter the list.
1. Click **Add to team**.
1. Repeat the process to add more team members.
{{< /docs/list >}}
![Add team member](/static/img/docs/manage-users/add-team-member-7-3.png)
## Remove a team member
Remove a user account from the team.
{{< docs/list >}}
{{< docs/shared "manage-users/view-team-list.md" >}}
1. Click the name of the team that you want to remove users from.
1. Click the red **X** next to the name of the user that you want to remove from the team and then click **Delete**.
{{< /docs/list >}}
## Set team member permissions
Change team member permission levels.
{{< docs/list >}}
{{< docs/shared "manage-users/view-team-list.md" >}}
1. Click the name of the team in which you want to change user permissions.
1. In the team member list, find and click the user account that you want to change. You can use the search field to filter the list if necessary.
1. Click the **Permission** list, and then click the new user permission level.
{{< /docs/list >}}
![Change team member permissions](/static/img/docs/manage-users/change-team-permissions-7-3.png)
## Delete a team
Permanently delete the team and all special permissions assigned to it.
{{< docs/list >}}
{{< docs/shared "manage-users/view-team-list.md" >}}
1. Click the red **X** next to the team that you want to delete and then click **Delete**.
{{< /docs/list >}}
@@ -1,95 +0,0 @@
+++
title = "Org admin tasks"
weight = 200
+++
# Manage users as an Org Admin
An _organization_ is a group of users on a Grafana server. Each user can belong to more than one organization. Every member of the organization has a _role_ in that organization that grants them a certain level of permissions. For more information, refer to [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}).
Organization Admins, also called Org Admins, can manage users in their organization. Some of their tasks overlap with the [Server Admin tasks]({{< relref "../server-admin/_index.md" >}}).
> **Note:** You must have Admin permissions in an organization in order to perform the tasks described in this page.
## View organization user account list
See a complete list of users with accounts in your Grafana organization. If necessary, you can use the search field to filter the list.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
Grafana displays all user accounts on the server, listed in alphabetical order by user name. The following information is displayed:
- **Login -** The value in the **Username** field of the account.
- **Email -** The email associated with the user account.
- **Name -** The value in the **Name** field of the account.
- **Seen -** How long ago the user logged in. If they have never logged in, then the default longest time (10y) is displayed.
- **Role -** The organization role currently assigned to the user.
![Org Admin user list](/static/img/docs/manage-users/org-user-list-7-3.png)
## Manage organization invitations
Organization Admins can invite users to their Grafana organizations and manage invitations. When an invited user signs in to Grafana, a user account is created for them if one does not already exist.
### Invite user to organization
Invite or add an existing user account to your organization.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
1. Click **Invite**.
1. Enter the following information:
- **Email or Username -** Either the email or username that the user will use to sign in to Grafana.
- **Name -** (Optional) The value in the **Name** field of the account.
- **Role -** Click the organization role to assign this user. For more information, refer to [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}).
- **Send invite email**
- **Yes -** If your organization has SMTP set up, then Grafana sends an email to the user inviting them to log in to Grafana and join your organization.
- **No -** The user is not sent an invitation, but they can sign in to the Grafana server with the email or username that you entered.
1. Click **Submit**.
![Invite User](/static/img/docs/manage-users/org-invite-user-7-3.png)
### View pending invitations
Review invitations of users that were invited but have not signed in.
![Pending Invites button](/static/img/docs/manage-users/pending-invites-button-7-3.png)
> **Note:** The button is only visible if there are unanswered invitations.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
1. Click **Pending Invites**.
Grafana displays a list of pending invitations. If necessary, you can use the search field to filter the list.
![Pending Invites list](/static/img/docs/manage-users/pending-invites-list-7-3.png)
### Cancel invitation
Revoke the invitation of a user that was invited but has not logged in.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
1. Click **Pending Invites**.
1. Click the red **X** next to the invitation that you want to cancel.
## Change organization role
Every user account is assigned an [Organization role]({{< relref "../../permissions/organization_roles.md" >}}). Organization admins can change the role assigned to a user in their organization.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
1. Find the user account for which you want to change the role. Use the search field to filter the list if necessary.
1. Click the **Role** list in the user account that you want to change. Grafana displays the list of available roles.
1. Click the role that you want to assign.
## Remove user from organization
Remove a user account from your organization. This prevents them from accessing the dashboards and data sources associated with the organization, but it does not remove the user account from the server.
1. Hover your cursor over the **Configuration** (gear) icon in the side menu.
1. Click **Users**.
1. Find the user account that you want to delete. Use the search field to filter the list if necessary.
1. Click the red **X** next to remove the user from your organization.
@@ -9,6 +9,6 @@ Grafana Server Admins use the **Server Admin** menu to manage user accounts and
They perform tasks described in the following pages:
- [Manage users as a Server Admin]({{< relref "server-admin-manage-users.md" >}}) - Describes user management tasks that Grafana Server Admins can perform.
- [Manage users as a Server Admin]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}) - Describes user management tasks that Grafana Server Admins can perform.
- [Manage organizations as a Server Admin]({{< relref "server-admin-manage-orgs.md" >}}) - Describes organization management tasks that Grafana Server Admins can perform.
- [User API]({{< relref "../../http_api/user.md" >}}) - Manage users or change passwords programmatically.
@@ -7,7 +7,8 @@ weight = 200
This topic explains organization management tasks performed by Grafana Server Admins.
In order to perform any of these tasks, you must be logged in to Grafana on an account with Grafana Server Admin permissions. For more information about Grafana Admin permissions, refer to [Grafana Server Admin role]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}})
In order to perform any of these tasks, you must be logged in to Grafana on an account with Grafana Server Admin permissions. For more information about Grafana Admin permissions, refer to [Grafana Server Admin role]
({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md" >}}).
> **Note:** The Grafana Server Admin role does not exist in Grafana Cloud. Grafana Cloud users cannot perform tasks listed in this section.
@@ -1,240 +0,0 @@
+++
title = "Manage users"
weight = 100
aliases =["/docs/grafana/latest/manage-users/add-or-remove-user/","/docs/grafana/latest/manage-users/enable-or-disable-user/"]
+++
# Manage users as a Server Admin
This topic explains user management tasks performed by Grafana Server Admins.
In order to perform any of these tasks, you must be logged in to Grafana on an account with Grafana Server Admin permissions. For more information about Grafana Admin permissions, refer to [Grafana Server Admin role]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}).
> **Note:** The Grafana Server Admin role does not exist in Grafana Cloud. Grafana Cloud users cannot perform tasks listed in this section.
## View the server user account list
See a complete list of users with accounts on your Grafana server.
{{< docs/shared "manage-users/view-server-user-list.md" >}}
Grafana displays all user accounts on the server, listed in alphabetical order by user name. The following information is displayed:
- **Login -** The value in the **Username** field of the account.
- **Email -** The email associated with the user account.
- **Name -** The value in the **Name** field of the account.
- **Seen -** How long ago the user logged in. If they have never logged in, then the default longest time (10y) is displayed.
- **Server Admin status -** If the user account has **Grafana Admin** option set, then a shield icon is displayed.
- **Account status -** If the account is disabled, then the **Disabled** label is displayed.
![Server Admin user list](/static/img/docs/manage-users/server-user-list-7-3.png)
## View user account details
See all details associated with a specific user account.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list.md" >}}
1. Click the user account you wish to view. If necessary, use the search field at the top of the tab to search for the specific user account that you need.
{{< /docs/list >}}
Each user account contains the following sections.
### User information
This section of the account contains basic user information. Users can change values in these fields on their own account.
- **Name**
- **Email**
- **Username**
- **Password**
![Server Admin user information section](/static/img/docs/manage-users/server-admin-user-information-7-3.png)
### Permissions
This indicates whether the user account has the Grafana Admin flag applied or not. If it is **Yes**, then the user is a Grafana Server Admin.
![Server Admin Permissions section](/static/img/docs/manage-users/server-admin-permissions-7-3.png)
### Organisations
This section lists the organizations the user account belongs to and the roles they hold within each organization.
![Server Admin Organizations section](/static/img/docs/manage-users/server-admin-organisations-7-3.png)
### Sessions
See recent sessions that the user was logged on, including when they logged on and information about the system the logged on with. You can force logouts if necessary.
![Server Admin Sessions section](/static/img/docs/manage-users/server-admin-sessions-7-3.png)
## Add a user account
Create a new user account at the server level.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list.md" >}}
1. Click **New user**.
1. Enter the following information:
- **Name -** Required.
- **E-mail -** Optional if a **Username** is entered.
- **Username -** Optional if an **E-mail** is entered.
- **Password -** Required.
1. Click **Create user**.
{{< /docs/list >}}
The user can change all this information after they log in. For instructions, refer to [Grafana user account profile]({{< relref "../user-admin/user-profile.md" >}}) and [Change your password]({{< relref "../user-admin/change-your-password.md" >}}).
## Edit a user account
Change information or settings in an individual user account.
### Edit user information
Edit information on an existing user account, including the user name, email, username, and password.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the User information section, click **Edit** next to the field that you want to change.
1. Enter the new value and then click **Save**.
{{< /docs/list >}}
### Change the password on a user account
Users can change their own passwords, but Server Admins can change user passwords as well.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the User information section, click **Edit** next to the **Password** field.
1. Enter the new value and then click **Save**. Grafana requires a value at least four characters long in this field.
{{< /docs/list >}}
### Delete a user account
Permanently remove a user account from the server.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Click **Delete User**.
1. Click **Delete user** to confirm the action.
{{< /docs/list >}}
### Enable or disable a user account
Temporarily turn on or off account access, but do not remove the account from the server.
#### Disable user account
Prevent a user from logging in with this account, but do not delete the account. You might disable an account if a colleague goes on sabbatical.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Click **Disable User**.
1. Click **Disable user** to confirm the action.
{{< /docs/list >}}
#### Enable a user account
Reactivate a disabled user account.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Click **Enable User**.
{{< /docs/list >}}
## Add/remove Grafana Admin flag
Give or remove the Grafana Server Admin role from a user account.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the Permissions section, click **Change**.
1. Click **Yes** or **No**, depending on whether or not you want this user account to have the Grafana Server Admin role.
1. Click **Change**.
{{< /docs/list >}}
The next time this user logs in, their permissions will be updated.
## Add a user to an organization
Add a user account to an existing organization. User accounts can belong to multiple organizations, but each user account must belong to at least one organization.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the Organisations section, click **Add user to organisation**.
1. In the **Add to an organization** window, select the **Organisation** that you are adding the user to.
1. Select the **Role** that the user should have in the organization.
1. Click **Add to organisation**.
{{< /docs/list >}}
## Remove a user from an organization
Remove a user account from an organization that it is currently assigned to.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the Organisations section, click **Remove from organisation** next to the organization that you want to remove the user from.
1. Click **Confirm removal**.
{{< /docs/list >}}
## Change organization role
Change the organization role assigned to a user account.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. In the Organisations section, click **Change role** next to the organization that you want to change the user role for.
1. Select the new role and then click **Save**.
{{< /docs/list >}}
## View and manage user sessions
See when a user last logged in and information about how they logged in. You can also force the account to log out of Grafana.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Scroll down to the Sessions section to view sessions associated with this user account.
{{< /docs/list >}}
## Force a user to log out of Grafana
If you suspect a user account is compromised or is no longer authorized to access the Grafana server, then you can force logout the account.
### Force logout of one device
Log the user account out of one specific device that is logged in to Grafana.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Scroll down to the Sessions section.
1. Click **Force logout** next to the session entry that you want logged out of Grafana.
1. Click **Confirm logout**.
{{< /docs/list >}}
### Force logout of all devices
Log the user account out of all devices that are logged in to Grafana.
{{< docs/list >}}
{{< docs/shared "manage-users/view-server-user-list-search.md" >}}
1. Scroll down to the Sessions section.
1. Click **Force logout from all devices**.
1. Click **Force logout**.
{{< /docs/list >}}
@@ -26,7 +26,7 @@ Every user is a member of at least one organization. You can have different role
1. Navigate to the Preferences tab. Hover your cursor over your user icon in the lower left corner of the screen, and then click **Preferences.**
1. Scroll down to the Organizations section.
- **Name -** The name of the organizations you are a member of in that Grafana instance.
- **Role -** The role you are assigned in the organization. Refer to [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}) about permissions assigned to each role.
- **Role -** The role you are assigned in the organization. Refer to [Organization users and permissions]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) for more information about permissions assigned to each role.
- **Current -** Grafana tags the organization that you are currently signed in to as _Current_. If you are part of multiple organizations, then you can click **Select** to switch to that organization.
## View your Grafana sessions