diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md index f1d507bd526..6abdfb93dd4 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md @@ -12,14 +12,14 @@ labels: - cloud - enterprise - oss -menuTitle: Azure AD/Entra ID OAuth -title: Configure Azure AD/Entra ID OAuth authentication +menuTitle: Entra ID OAuth +title: Configure Entra ID OAuth authentication weight: 800 --- -# Configure Azure AD/Entra ID OAuth authentication +# Configure Entra ID OAuth authentication -The Azure AD authentication allows you to use a Microsoft Entra ID (formerly known as Azure Active Directory) tenant as an identity provider for Grafana. You can use Entra ID application roles to assign users and groups to Grafana roles from the Azure Portal. +The Entra ID authentication allows you to use a Microsoft Entra ID (formerly known as Azure Active Directory) tenant as an identity provider for Grafana. You can use Entra ID application roles to assign users and groups to Grafana roles from the Azure Portal. {{< admonition type="note" >}} If Users use the same email address in Microsoft Entra ID that they use with other authentication providers (such as Grafana.com), you need to do additional configuration to ensure that the users are matched correctly. Please refer to [Using the same email address to login with different identity providers](../#using-the-same-email-address-to-login-with-different-identity-providers) for more information. @@ -27,7 +27,7 @@ If Users use the same email address in Microsoft Entra ID that they use with oth ## Create the Microsoft Entra ID application -To enable the Azure AD/Entra ID OAuth, register your application with Entra ID. +To enable the Entra ID OAuth, register your application with Entra ID. 1. Log in to [Azure Portal](https://portal.azure.com), then click **Microsoft Entra ID** in the side menu. @@ -119,7 +119,7 @@ To enable the Azure AD/Entra ID OAuth, register your application with Entra ID. 1. Click **Add user/group** to add a user or group to the Grafana roles. {{< admonition type="note" >}} -When assigning a group to a Grafana role, ensure that users are direct members of the group. Users in nested groups will not have access to Grafana due to limitations within Azure AD/Entra ID side. For more information, see [Microsoft Entra service limits and restrictions](https://learn.microsoft.com/en-us/entra/identity/users/directory-service-limits-restrictions). +When assigning a group to a Grafana role, ensure that users are direct members of the group. Users in nested groups will not have access to Grafana due to limitations within Entra ID side. For more information, see [Microsoft Entra service limits and restrictions](https://learn.microsoft.com/en-us/entra/identity/users/directory-service-limits-restrictions). {{< /admonition >}} ### Configure application roles for Grafana in the Azure Portal @@ -226,9 +226,9 @@ If the setting is set to `false`, the user is assigned the role of `Admin` of th Ensure that you have followed the steps in [Create the Microsoft Entra ID application](#create-the-microsoft-entra-id-application) before you begin. -## Configure Azure AD authentication client using the Grafana UI +## Configure Entra ID authentication client using the Grafana UI -As a Grafana Admin, you can configure your Azure AD/Entra ID OAuth client from within Grafana using the Grafana UI. To do this, navigate to the **Administration > Authentication > Azure AD** page and fill in the form. If you have a current configuration in the Grafana configuration file, the form will be pre-populated with those values. Otherwise the form will contain default values. +As a Grafana Admin, you can configure your Entra ID OAuth client from within Grafana using the Grafana UI. To do this, navigate to the **Administration > Authentication > Azure AD** page and fill in the form. If you have a current configuration in the Grafana configuration file, the form will be pre-populated with those values. Otherwise the form will contain default values. After you have filled in the form, click **Save** to save the configuration. If the save was successful, Grafana will apply the new configurations. @@ -238,7 +238,7 @@ If you need to reset changes you made in the UI back to the default values, clic If you run Grafana in high availability mode, configuration changes may not get applied to all Grafana instances immediately. You may need to wait a few minutes for the configuration to propagate to all Grafana instances. {{< /admonition >}} -## Configure Azure AD authentication client using the Terraform provider +## Configure Entra ID authentication client using the Terraform provider ```terraform resource "grafana_sso_settings" "azuread_sso_settings" { @@ -270,17 +270,17 @@ resource "grafana_sso_settings" "azuread_sso_settings" { Refer to [Terraform Registry](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/sso_settings) for a complete reference on using the `grafana_sso_settings` resource. -## Configure Azure AD authentication client using the Grafana configuration file +## Configure Entra ID authentication client using the Grafana configuration file Ensure that you have access to the [Grafana configuration file](../../../configure-grafana/#configuration-file-location). -### Enable Azure AD OAuth in Grafana +### Enable Entra ID OAuth in Grafana Add the following to the [Grafana configuration file](../../../configure-grafana/#configuration-file-location): ``` [auth.azuread] -name = Azure AD +name = Entra ID enabled = true allow_sign_up = true auto_login = false @@ -321,7 +321,7 @@ When a user logs in using an OAuth provider, Grafana verifies that the access to Grafana uses a refresh token to obtain a new access token without requiring the user to log in again. If a refresh token doesn't exist, Grafana logs the user out of the system after the access token has expired. -Refresh token fetching and access token expiration check is enabled by default for the AzureAD provider since Grafana v10.1.0. If you would like to disable access token expiration check then set the `use_refresh_token` configuration value to `false`. +Refresh token fetching and access token expiration check is enabled by default for the Entra ID provider since Grafana v10.1.0. If you would like to disable access token expiration check then set the `use_refresh_token` configuration value to `false`. {{< admonition type="note" >}} The `accessTokenExpirationCheck` feature toggle has been removed in Grafana v10.3.0 and the `use_refresh_token` configuration value will be used instead for configuring refresh token fetching and access token expiration check. @@ -427,7 +427,7 @@ To learn more, refer to the [Team Sync](https://grafana.com/docs/grafana/::` mappings. Value can be `*` meaning "All users". Role is optional and can have the following values: `None`, `Viewer`, `Editor` or `Admin`. For more information on external organization to role mapping, refer to [Org roles mapping example](#org-roles-mapping-example). | | -| `allow_assign_grafana_admin` | No | No | Set to `true` to automatically sync the Grafana server administrator role. When enabled, if the Azure AD/Entra ID user's App role is `GrafanaAdmin`, Grafana grants the user server administrator privileges and the organization administrator role. If disabled, the user will only receive the organization administrator role. For more details on user role mapping, refer to [Map roles](#map-roles). | `false` | +| `allow_assign_grafana_admin` | No | No | Set to `true` to automatically sync the Grafana server administrator role. When enabled, if the Entra ID user's App role is `GrafanaAdmin`, Grafana grants the user server administrator privileges and the organization administrator role. If disabled, the user will only receive the organization administrator role. For more details on user role mapping, refer to [Map roles](#map-roles). | `false` | | `skip_org_role_sync` | No | Yes | Set to `true` to stop automatically syncing user roles. This will allow you to set organization roles for your users from within Grafana manually. | `false` | -| `allowed_groups` | No | Yes | List of comma- or space-separated groups. The user should be a member of at least one group to log in. If you configure `allowed_groups`, you must also configure Azure AD/Entra ID to include the `groups` claim following [Configure group membership claims on the Azure Portal](#configure-group-membership-claims-on-the-azure-portal). | | +| `allowed_groups` | No | Yes | List of comma- or space-separated groups. The user should be a member of at least one group to log in. If you configure `allowed_groups`, you must also configure Entra ID to include the `groups` claim following [Configure group membership claims on the Azure Portal](#configure-group-membership-claims-on-the-azure-portal). | | | `allowed_organizations` | No | Yes | List of comma- or space-separated Azure tenant identifiers. The user should be a member of at least one tenant to log in. | | | `allowed_domains` | No | Yes | List of comma- or space-separated domains. The user should belong to at least one domain to log in. | | -| `domain_hint` | No | Yes | The realm of the user in a federated directory. This skips the email-based discovery process that the user goes through on the Azure AD/Entra ID sign-in page, for a slightly more streamlined user experience. More info [here](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#send-the-sign-in-request). | | +| `domain_hint` | No | Yes | The realm of the user in a federated directory. This skips the email-based discovery process that the user goes through on the Entra ID sign-in page, for a slightly more streamlined user experience. More info [here](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#send-the-sign-in-request). | | | `tls_skip_verify_insecure` | No | No | If set to `true`, the client accepts any certificate presented by the server and any host name in that certificate. _You should only use this for testing_, because this mode leaves SSL/TLS susceptible to man-in-the-middle attacks. | `false` | | `tls_client_cert` | No | No | The path to the certificate. | | diff --git a/public/app/features/auth-config/constants.ts b/public/app/features/auth-config/constants.ts index 954f35e7be5..3a98f08ba18 100644 --- a/public/app/features/auth-config/constants.ts +++ b/public/app/features/auth-config/constants.ts @@ -9,7 +9,7 @@ export const UIMap: Record = { google: ['google', 'Google'], generic_oauth: ['lock', 'Generic OAuth'], grafana_com: ['grafana', 'Grafana.com'], - azuread: ['microsoft', 'Azure AD'], + azuread: ['microsoft', 'Entra ID'], okta: ['okta', 'Okta'], scim: ['scim', 'SCIM'], }; diff --git a/public/app/features/auth-config/fields.tsx b/public/app/features/auth-config/fields.tsx index 029e67b581a..96bb2e3ccea 100644 --- a/public/app/features/auth-config/fields.tsx +++ b/public/app/features/auth-config/fields.tsx @@ -906,7 +906,7 @@ export function fieldMap(provider: string): Record { label: t('auth-config.fields.domain-hint-label', 'Domain hint'), description: t( 'auth-config.fields.domain-hint-description', - 'Parameter to indicate the realm of the user in the Azure AD/Entra ID tenant and streamline the login process.' + 'Parameter to indicate the realm of the user in the Entra ID tenant and streamline the login process.' ), type: 'text', validation: { diff --git a/public/locales/en-US/grafana.json b/public/locales/en-US/grafana.json index 38084055225..d976f91085a 100644 --- a/public/locales/en-US/grafana.json +++ b/public/locales/en-US/grafana.json @@ -3240,7 +3240,7 @@ "define-allowed-teams-ids-label": "Define allowed teams IDs", "display-name-description": "Will be displayed on the login page as \"Sign in with ...\". Helpful if you use more than one identity providers or SSO protocols.", "display-name-label": "Display name", - "domain-hint-description": "Parameter to indicate the realm of the user in the Azure AD/Entra ID tenant and streamline the login process.", + "domain-hint-description": "Parameter to indicate the realm of the user in the Entra ID tenant and streamline the login process.", "domain-hint-label": "Domain hint", "domain-hint-valid-domain": "This field must be a valid domain.", "email-attribute-name-description": "Name of the key to use for user email lookup within the attributes map of OAuth2 ID token.",