We're excited to announce Grafana v9.1, with a variety of improvements that focus on Grafana's usability, performance, and security.
Read on to learn about new options to share and embed dashboards, search and navigation enhancements, new panel options, and additional authentication features.
You can also find out more about new single sign-on and role-based access control options in Grafana Enterprise, and more.
#### Grafana service accounts are generally available
Service accounts are an evolution in machine access within Grafana.
You can create multiple API tokens per service account with independent expiration dates, and temporarily disable a service account without deleting it.
These benefits make service accounts a more flexible way for Terraform and other apps to authenticate with Grafana.
Service accounts also work with [role-based access control]({{< relref "../administration/roles-and-permissions/access-control" >}}) in [Grafana Enterprise]({{< relref "../introduction/grafana-enterprise" >}}).
You can improve security by granting service accounts specific roles to limit the functions they can perform.
Service accounts have been in beta since Grafana v8.5.
During that time, we've improved the UI and migration path from API keys, made it possible to add service accounts to teams, and inherit team permissions.
To learn more about service accounts, see the [documentation]({{< relref "../administration/service-accounts" >}}).
{{<figuresrc="/static/img/docs/service-accounts/add-service-account-token-9-1.png"max-width="750px"caption="Adding a service account token">}}
#### JWT URL embedding
You can now easily embed Grafana in other applications by adding a JWT token directly in the Grafana's URL, for example,`https://example.grafana.net/dashboard/uuid?aut_token=<jwt_token>`.
When the JWT token is passed through the request URL to Grafana, Grafana validates and authenticates the token linked to a specific user, allowing access to dashboards which that user can view.
To see JWT URL embedding in action, see the [sample project](https://github.com/grafana/grafana-iframe-oauth-sample).
> **Note:** JWT URL Embedding and `allow_embedding` are not available to Grafana Cloud users. For Grafana Cloud, use [public dashboards](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/dashboards/share-dashboards-panels/shared-dashboards/). To enable that, [open a ticket with our Support team](/docs/grafana-cloud/account-management/support/).
You can now use GitHub OAuth2 to map users or teams to specific [Grafana organization roles]({{< relref "../administration/roles-and-permissions#organization-roles" >}}) by using `role_attribute_path` configuration option.
{{<figuresrc="/static/img/docs/permissions/org-role-mapping-github-9-1.png"max-width="750px"caption="Configuring GitHub OAuth2 authentication with role mapping">}}
### Search and navigation
#### (Beta) Panel title search and search improvements
We've improved the performance of searching by panel title.
If a panel's title matches your search query, it will be displayed in the search results.
This feature will be rolled out to Grafana Cloud users over the course of several weeks, or can be accessed by enabling the `panelTitleSearch` feature toggle.
Panel title search uses our updated dashboard search approach.
Previously, Grafana used SQL database queries to find dashboards by title.
With the feature toggle enabled, Grafana can build an in-memory index of all dashboards.
As part of the upcoming improvements to Grafana's navigation, you can now directly access your [starred dashboards]({{< relref "../dashboards/use-dashboards" >}}) from the navigation bar.
You can now measure both distances and areas on Geomap visualizations by using the panel's new [measure tools]({{< relref "../panels-visualizations/visualizations/geomap#show-measure-tools" >}}).
To learn more about the Geomap panel, see the [documentation]({{< relref "../panels-visualizations/visualizations/geomap" >}}).
{{<figuresrc="/static/img/docs/enterprise/reporting-draft-9-1.png"max-width="750px"caption="Saving a report as a draft">}}
#### (Beta) Configure custom branding in Grafana's UI
Custom branding (previously referred to as whitelabeling) lets you customize parts of Grafana's UI.
You can add links to the footer to your internal documentation, guides, or support, and you can update Grafana's sign-in page, logo, and other graphic elements to reflect your team or company identity.
Previously, you could only configure custom branding in Grafana's configuration files.
Now, you can experiment with customization in Grafana's Admin section in the UI, or customize branding and links using the API.
This is an early-access feature available only to self-managed customers.
In Grafana version 9.0, we [revamped]({{< relref "./whats-new-in-v9-0#envelope-encryption-is-generally-available-and-enabled-by-default" >}}) the method Grafana uses to encrypt secrets, like data source credentials, so that you can rotate encryption keys and integrate with a key management system like Hashicorp Vault, AWS Key Management Service, or Azure Key Vault.
To learn more, see our guide to [configuring database encryption]({{< relref "../setup-grafana/configure-security/configure-database-encryption#configure-database-encryption" >}}).
#### Audit all actions in Grafana using verbose logging
Auditing logs helps you manage and mitigate activity and meet compliance requirements.
By default, Grafana emits an audit log with every action that changes something (like a user creating or updating a dashboard or updating another user's permissions).
If you want to record all actions on the Grafana server, including GETs and page views, you can now turn on `verbose mode`.
This results in more logs, but it can be useful to debug specific issues or make sure you catch everything happening in Grafana for security or compliance reasons.
#### See (and don't edit) users synced from SAML, LDAP, and OAuth identity providers
When you synchronize users from a SAML, LDAP, or OAuth provider, some user settings, such as name and email address, are synchronized from your identity provider.
Previously, you could edit those settings in the Grafana UI, but they would revert back.
To make user management clearer, you can now see which settings are synchronized from your identity provider, but you cannot edit those settings.
{{<figuresrc="/static/img/docs/enterprise/oauth-synced-user-9-1.png"max-width="750px"caption="Non-interactive view of a user synced via OAuth">}}
#### Support wildcards for LDAP groups in team sync
Team sync lets you set up synchronization between your authentication provider's teams and Grafana teams.
To leverage your existing Active Directory in an efficient way without having to create multiple teams, you can now use wildcards when configuring LDAP groups, so that multiple Active Directory groups can be added at once to a single team.
{{<figuresrc="/static/img/docs/enterprise/ldap-wildcard-teamsync-9-1.png"max-width="750px"caption="Using wildcard mapping for team sync">}}
#### Redirect binding support for AzureAD SAML Single Logout
SAML Single Logout allows users to log out from all applications associated with the current IdP (Identity Provider) session established via SAML Single Sign-On (SSO).
To enable integration of more use cases, we have added support for an HTTP-Redirect binding for a Single Logout.
