---
# Grafana Authentication with Microsoft Entra ID (earlier known as Azure AD) and Okta
**URL:** https://www.sigmoid.com/blogs/grafana-authentication-with-microsoft-entra-id-and-okta/
Date: 2023-12-18
Author: Sigmoid
Post Type: post
Summary: A recent study on cyber security revealed that over 82% of data breaches were caused by authentication issues — stolen or weak...Read More...
Categories: Data Management
Tags: Data Management, DataOps
Featured Image: https://www.sigmoid.com/wp-content/uploads/2023/12/Grafana-Authentication.jpg
---
A recent study on cyber security revealed that over [82% of data breaches](https://www.strongdm.com/blog/authentication-vulnerabilities#:~:text=According%20to%20Statista%2C%20more%20than,issues%20%E2%80%94%20stolen%20or%20weak%20credentials.) were caused by authentication issues — stolen or weak credentials. With the rising demand for robust security measures and seamless user experiences, managing access to critical monitoring and observability platforms has become increasingly complex.
Grafana stands out as a leading open-source solution to this problem with an array of authentication methods for streamlined yet secure access control. It is a popular open-source platform for monitoring and observability, known for its flexibility and versatility in visualizing [data](/data-engineering/) from various sources. There are various authentication methods available in Grafana to verify user identity. The authentication configuration dictates which users can access Grafana and the methods they can use for logging in.
In this blog post, we will go through the process of setting up Grafana in [Kubernetes ](/blogs/process-workflow-for-running-spark-application-on-kubernetes-using-airflowark/) with external identity providers like Microsoft Entra ID and Okta for authentication.
### Prerequisites -
Before we begin the configuration process, we must ensure the following prerequisites:
- A running Kubernetes cluster.
- Helm is installed on the local machine and Tiller (Helm's server component) is running in the cluster.
- An active Microsoft Entra ID account.
- An active Okta account.
- Access to the Kubernetes cluster for Helm chart deployment.
## Grafana Deployment -
This section will guide you through the necessary steps to deploy Grafana within a Kubernetes environment using the Helm chart. It is a streamlined approach to managing applications in Kubernetes clusters and provides a foundation for implementing secure and efficient monitoring solutions.
Link to helm charts: [https://github.com/grafana/helm-charts/blob/main/charts/grafana/values.yaml. ](https://github.com/grafana/helm-charts/blob/main/charts/grafana/values.yaml)
- Open a terminal and ensure Helm is initialized:
helm init
- Next, we'll need to add the official Grafana Helm repository:
helm repo add grafana https://grafana.github.io/helm-charts
- Update the local Helm repositories:
helm repo update
- Now we can deploy Grafana with Azure AD or with Okta authentication using the below steps -
## Configure Azure AD Authentication -
This segment outlines the essential steps required to configure Grafana's authentication with Microsoft Entra ID. It ensures a robust and secure authentication mechanism and enables you to control user access and permissions efficiently.
- Log in to Azure Portal ([https://portal.azure.com/ ](https://portal.azure.com/)), then click Azure Active Directory in the side menu.
- Navigate to "Azure Active Directory" and select "App registrations."
- Click "New Registration" to create a new application registration.
- Provide a name for the application, and select the appropriate redirect URI for Grafana and https://your-grafana-url. Then click Register.
- After registering the application, The app’s Overview page opens. Note down the "Application (client) ID" and the "Directory (tenant) ID."
- Under the "Certificates & secrets" section, generate a client secret, and make sure to note it down securely.
- In the Grafana helm chart, we can set configuration values using the values.yaml file. Below is the sample configuration to add in values.yaml under grafana.ini section:
```
grafana.ini:
auth.azuread:
name: Azure AD
enabled: true
allow_sign_up: true
auto_login = false
client_id: YOUR_CLIENT_ID
client_secret: YOUR_SECRET_ID
scopes: openid email profile
auth_url:
https://login.microsoftonline.com/AZURE_TENENT_ID/oauth2/v2.0/authorize
token_url: https://login.microsoftonline.com/AZURE_TENENT_ID/oauth2/v2.0/token
allowed_groups: GROUP_OBJECT_ID
allowed_organizations: TENANT_ID
```
where
- allowed_organizations is to limit access to authenticated users who are members of one or more tenants. Set allowed_organizations to a comma- or space-separated list of tenant IDs. We can find tenant IDs on the Azure portal under Azure Active Directory -> Overview
- allowed_groups limit access to authenticated users from one or more groups, set allowed_groups to a comma- or space-separated list of group object IDs. The object IDs for a specific group on the Azure portal: Go to Azure Active Directory -> Groups.
- Replace the placeholders with the Azure AD credentials and customize other settings as needed. We can also use environment variables to configure client_id and client_secret instead of hardcoding them.
- Install or upgrade Grafana using the helm chart
helm upgrade -install chart_name -f values.yaml.
- We will now get “**Sign in with Microsoft**” option on Grafana web
## Configure Okta Authentication -
Explore the step-by-step process of integrating Okta's authentication services with Grafana, allowing for a smooth and secure user authentication experience.
- Log in to the Okta admin console ([https://your-okta-domain.okta.com](https://your-okta-domain.okta.com/)).
- In the Okta dashboard, navigate to "Applications" and click "Add Application."
- Choose the "Web" platform, and then select "OpenID Connect."
- Configure the OpenID Connect application settings, including the "Login redirect URIs" like https://your-grafana-url/login/okta and https://your-grafana-url.
- Save the application settings and note down the "Client ID" and "Client Secret."
- In the Grafana helm chart, we can set configuration values using a values.yaml file. Below is the sample configuration to add in values.yaml under grafana.ini section:
```
grafana.ini:
auth.okta:
name = Okta
enabled = true
allowed_domains: example.com
client_id = YOUR_OKTA_CLIENT_ID
client_secret = YOUR_OKTA_CLIENT_SECRET
scopes = openid profile email
auth_url = https://your-okta-domain.okta.com/oauth2/default/v1/authorize
token_url = https://your-okta-domain.okta.com/oauth2/default/v1/token
api_url = https://your-okta-domain.okta.com/oauth2/default/v1/userinfo
```
- Replace the placeholders with the okta credentials and customize other settings as needed. We can also use environment variables to configure sensitive values instead of hardcoding it.
- Install or upgrade grafana using helm chart
helm upgrade -install chart_name -f values.yaml .
- We will now get “**Sign in with Okta**” option on Grafana web
## Author Bio:
Swapnil More is the DataOps Engineer II at Sigmoid with over 4+ years of hands-on experience in DevOps, DataOps, CloudOps etc . As a DataOps Engineer, Swapnil is passionate about automating and optimizing the software development process, streamlining continuous deployment pipelines, infrastructure automation and management.
[lc_the_tags]
## Featured blogs
[lc_get_posts post_type="post"
posts_per_page="4" orderby="date" output_view="lc_get_posts_mycustom_view" output_number_of_columns="4"
output_wrapper_class="row" output_article_class="shadow" output_hide_elements="Excerpt"
output_excerpt_length="0" output_excerpt_text="Read More" output_heading_tag="span"
output_featured_image_format="thumbnail" output_featured_image_class="card-img-left" ]
## Share
[addtoany]
## Subscribe to get latest insights
## Talk to our experts
Get the best ROI with Sigmoid’s services in data engineering and AI
## Suggested readings
[View all](/blogs/)
#### [Best practices for faster development of data pipelines on Databricks using dbx](/blogs/best-practices-for-faster-development-of-data-pipelines-on-databricks-using-dbx/)
[Read blog](/blogs/best-practices-for-faster-development-of-data-pipelines-on-databricks-using-dbx/)
#### [Ensuring PII Security in Enterprises with an Azure Framework](/blogs/implementation-of-a-privacy-first-pii-framework-on-azure/)
[Read blog](/blogs/implementation-of-a-privacy-first-pii-framework-on-azure/)
#### [Process workflow for running Spark application on Kubernetes using Airflow](/blogs/process-workflow-for-running-spark-application-on-kubernetes-using-airflowark/)
[Read blog](/blogs/process-workflow-for-running-spark-application-on-kubernetes-using-airflowark/)
---
## Categories
- Data Management
---
## Navigation
- [WordPress.org](https://wordpress.org/)
- [Documentation](https://wordpress.org/documentation/)
- [Learn WordPress](https://learn.wordpress.org/)
- [Support](https://wordpress.org/support/forums/)
- [Feedback](https://wordpress.org/support/forum/requests-and-feedback)
- [Sigmoid](https://www.sigmoid.com/)
- [Community](https://community.wpmanageninja.com/portal/space/fluent-forms/home)
- [Docs](https://wpmanageninja.com/docs/fluent-form/)
- [Developer Docs](https://developers.fluentforms.com/)
- [Documentation](https://imagify.io/documentation/)
- [Rate Imagify on WordPress.org](https://wordpress.org/support/view/plugin-reviews/imagify?rate=5#postform)
- [Manage](admin.php?page=litespeed)
- [Settings](admin.php?page=litespeed-cache)
- [Image Optimization](admin.php?page=litespeed-img_optm)
- [Company](/about-sigmoid)
- [Newsroom](/newsroom)
- [Life at Sigmoid](/careers)
- [Takshashila](/takshashila)
- [Contact Us](/contact-us)
- [AI Strategy Blueprint your AI advantage](/enterprise-ai-strategy/)
- [Generative AI Drive innovation with Generative AI](/generative-ai/)
- [Responsible AI Build trust with ethical AI practices](/responsible-ai-in-enterprise/)
- [Agentic AI Reshape business with scalable agentic systems](/agentic-ai-solutions/)
- [AI Managed Services Ensure reliable AI performance](/ai-managed-services/)
- [Advanced Analytics Transform your business with data-driven insights](/advanced-data-analytics-solutions/)
- [Start Assessment](/agentic-ai-readiness-index/)
- [Data Strategy Strong data foundations for scalable AI](/data-analytics-strategy/)
- [Data Management Leverage data as a strategic asset](/ai-data-management-services/)
- [Data Ops Automate data for speed and quality](/data-devops/)
- [Data Engineering Deliver insights faster with scalable pipelines](/data-engineering/)
- [Cloud Transformation Modernize data to maximise efficiency](/cloud-migration/)
- [Download Whitepaper](/ebooks-whitepapers/building-data-products-in-a-data-mesh-to-drive-business-value/)
- [Data Modeling Structure data for better decisions](/data-modeling-services/)
- [Data Visualization Transform data into actionable stories](/data-visualization-service/)
- [BI Migration Enhance decision making with modern BI tools](/bi-migration/)
- [Data Observability Build trust with healthy, accurate data](/data-observability/)
- [Automated Insights Make smarter decisions with auto-generated insights](/automated-insights/)
- [Download Whitepaper](/ebooks-whitepapers/power-bi-hacks/)
- [CPG & Retail End-to-end analytics for planning, operations, and commercial excellence](/industries/cpg-analytics/)
- [Life Sciences Trusted intelligence across clinical, commercial, and operational workflows](/industries/life-sciences/)
- [Financial Services AI-powered analytics for risk, compliance and customer experience](/industries/banking-financial-analytics-services/)
- [Read case study](/case-studies/data-clean-room-enables-real-time-insights-to-improve-operational-efficiency/)
- [MediaIQ Advanced platform for in-flight marketing measurement](/accelerators/sigmoid-mediaiq-multi-touch-attribution-tool/)
- [CampaignIQ AI-driven platform for optimized campaign budget allocation](/accelerators/sigmoid-campaigniq/)
- [AssistBot GenAI email assistant that automates human-like responses](/accelerators/sigmoid-assistbot-for-ai-email-assistant/)
- [CreativeBot GenAI tool for personalized and brand-aligned creative design](/accelerators/sigmoid-creativebot/)
- [SocialBot GenAI platform to analyze digital conversations and trends](/accelerators/#marketing|socialbot)
- [DemandIQ Predict trends accurately and optimize inventory management](/accelerators/sigmoid-demandiq/)
- [NetworkIQ Track and optimize logistics operations in real-time to quickly address disruptions](/accelerators/sigmoid-networkiq/)
- [SupplyIQ End-to-end platform to optimize supply chain operations](/accelerators/sigmoid-supplyiq/)
- [ProcurementIQ Automated procurement operations for maximum savings, compliance and efficiency](/accelerators/sigmoid-procurementiq/)
- [RapidML Accelerated deployment for machine learning models](/accelerators/sigmoid-rapidml/)
- [DataGuard Comprehensive platform for proactive data quality management](/accelerators/data-quality-tool-sigmoid-dataguard/)
- [CloudPulse Cloud cost optimization platform with multi-cloud management](/accelerators/sigmoid-cloudpulse/)
- [RAPID GenAI foundation with built-in governance and cost clarity](/accelerators/sigmoid-rapid/)
- [AnalyticsBot GenAI based platform to streamline decision-making in analytics](/accelerators/sigmoid-analyticsbot/)
- [DataConnect Seamlessly ingest, integrate and harmonize data from diverse sources](/accelerators/sigmoid-dataconnect/)
- [Reconica AI-powered data harmonization and reconciliation engine](/accelerators/sigmoid-reconica/)
- [ConverseBot GenAI driven insights generation for automated insights from reports](/accelerators/#sales|conversebot)
- [iNRM Cross-lever revenue growth optimization platform](/accelerators/sigmoid-inrm/)
- [AssortmentIQ Optimize shelf layouts and assortment mix at scale with AI-based insights](/accelerators/sigmoid-assortmentiq/)
- [Read Whitepaper](/ebooks-whitepapers/building-agentic-ai-chatbots-for-business-process-transformation/)
- [Listen Podcast](/events/podcast/how-jack-in-the-box-is-redefining-personalization-and-supply-chain-with-ai/)
- [Blogs](/blogs/)
- [White Papers](/ebooks-whitepapers/)
- [Case Studies](/case-studies/)
- [Podcast](/events/podcast/#Podcasts)
- [Read Blog](/blogs/the-genai-adoption-triad-responsibility-ethics-and-explainability/)
- [ConverseBot](/accelerators/#sales|conversebot/)
## Tags
- Data Management
- DataOps
---
## Footer Links
- [Talk to our AI experts](/contact-us/)
- [AI Strategy](/enterprise-ai-strategy/)
- [Agentic AI](/agentic-ai-solutions/)
- [Generative AI](/generative-ai/)
- [AI Managed Services](/ai-managed-services/)
- [Responsible AI](/responsible-ai-in-enterprise/)
- [Advanced Analytics](/advanced-data-analytics-solutions/)
- [Data Strategy](/data-analytics-strategy//)
- [Data Engineering](/data-engineering/)
- [Data Management](/ai-data-management-services/)
- [Cloud Transformation](/cloud-transformation/)
- [Data Ops](/data-devops/)
- [Data Visualization](/data-visualization-service/)
- [Automated Insights](/automated-insights/)
- [BI Migration](/bi-migration/)
- [Data Modeling](/data-modeling-services/)
- [Data Observability](/data-observability/)
- [CPG & Retail](/industries/cpg-analytics/)
- [Financial Services](/industries/banking-financial-analytics-services/)
- [Life Sciences](/industries/life-sciences/)
- [Case Studies](/case-studies/)
- [Thought Leadership](/ebooks-whitepapers/)
- [Blogs](/blogs/)
- [Company](/about-sigmoid/)
- [Newsroom](/newsroom/)
- [Accelerators](/accelerators/)
- [Careers](/careers/)
- [Privacy Policy |](/privacy-policy/)
- [Cookie Policy](/cookie-policy/)