IAM (Access control) changes from Grafana Viewer to Grafana Limited Viewer are not recognized in Azure Managed Grafana - Users section

Question

IAM (Access control) changes from Grafana Viewer to Grafana Limited Viewer are not recognized in Azure Managed Grafana - Users section

Mike Rees 40 Microsoft Employee

I changed 5 users role assignments in the Azure Managed Grafana portal, through IAM (Access control) from "Grafana Viewer" role to "Grafana Limited Viewer" role.

When I log into the AMG workspace, I check the Users page (which is managed by syncing with Azure), I see no changes for these users. They are still showing with the 'Viewer' role. I have refereshed, signed out, ctrl-shift-r, and logged out of my desktop and back in. I've even waited an hour before refreshing again.

Should that change? Or does Grafana Limited Viewer role appear as Viewer in that screen too?
Is there a way to trigger the sync?

I know the syncing isn't working. I'm certain of it since there are still users showing up that no longer have access to grafana. These users left the company and their group memberships are gone (groups that provided them access), and they still appear. These users have been gone for almost a year, so something is wrong with the syncing for sure.

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-05-07T19:58:15.4733333+00:00
Hello Mike Rees, you changed Multiple users Azure RBAC role assignments in Azure Managed Grafana (AMG) from Grafana Viewer to Grafana Limited Viewer using IAM (Access Control). However, In the Grafana Users page (inside the Grafana UI), the users still appear as "Viewer".

The "Viewer" label in the Grafana UI is expected behavior for Limited Viewer users. The Grafana Limited Viewer role in Azure maps to "No Basic Role" in the Grafana docs. This is a subtlety in how AMG surfaces roles internally the Grafana UI itself doesn't have a distinct "Limited Viewer" label. So what you're seeing in the Users page isn't necessarily wrong.

Manage access and permissions for users and identities - Azure Managed Grafana | Microsoft Learn

Regarding the sync delay, there are two relevant notes from Microsoft's docs:

Users aren't listed in the Grafana UI Users menu right after being added to a Grafana built-in RBAC role, such as Grafana Viewer. So syncing isn't instant by design.

If you recently addressed this problem and have been assigned a sufficient Grafana role, you may need to wait for some time before the cookie expires and gets refreshed. This process normally takes about 5 minutes. If in doubt, delete all cookies or start a private browser session to force a fresh new cookie with new role information.

Troubleshoot Azure Managed Grafana | Microsoft Learn

There is no manual sync trigger exposed in the UI, the sync is automatic and driven by Entra ID token refresh cycles. To verify the change actually worked, rather than looking at the Grafana Users page label (which won't clearly show "Limited Viewer"), you should check back in Azure Portal > IAM and confirm the old "Grafana Viewer" assignment is gone and replaced with "Grafana Limited Viewer" for those users.

The users who no longer have access to Grafana (removed from Entra ID groups, left the company) are still showing up in the Azure Managed Grafana (AMG) Users page almost a year later.

Azure Managed Grafana does not continuously synchronize the Grafana Users list with Microsoft Entra ID. User entries are created or updated only when users sign in, and there is no background process to remove users who have lost access. As a result, users can remain visible in the Grafana UI even after their access is revoked. This behavior does not impact security, as access enforcement is handled by Azure RBAC/IAM. Hope this helps, if you have any further questions or need additional clarification, feel free to reach out. Thanks!

Answer accepted by question author

AI answer

The behavior described is by design for Azure Managed Grafana.

Azure Managed Grafana stores Grafana built‑in RBAC role assignments (such as Grafana Viewer and Grafana Limited Viewer) in Microsoft Entra ID. The Users list in the Grafana UI is not continuously synchronized with Microsoft Entra ID. Instead:

Users and their assigned roles are only listed or updated in Administration > Users and access > Users after they sign in to the Azure Managed Grafana workspace.
There is no automatic background sync that removes users who no longer have access or immediately reflects role changes.
For performance reasons, Azure Managed Grafana does not periodically query Microsoft Entra ID for current assignments, and there is no manual “sync now” control.

Therefore:

Changing a user’s role assignment in Azure IAM from Grafana Viewer to Grafana Limited Viewer will not immediately update what is shown in the Grafana Users page.
The entry for a user is refreshed only when that user signs in again; until then, the old role can continue to appear.
Users who left the company or lost access can remain visible in the Users list because their entries are not automatically removed; their presence there does not mean they still have access.

There is no supported way to force a global sync from the Grafana side. To see updated roles:

Have each affected user sign in to the Azure Managed Grafana workspace again; their role will then be refreshed and reflected in the Users list.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

1 additional answer

Your answer

Answer 1

Mike Rees 40 Microsoft Employee

Well, that explains this, but as far as the design of users that have left the company, that is a crappy design IMO. I have to continue to see users who have left the company, with the visual indicating they still have access? Yikes. If someone else is managing user access into these workspaces, these questions will popup again. We shall see if the display updates for role changes when they log in next, but again this seems odd to me. Why store and display old information? Part of good security is understanding what is currently set up. Seeing old data is not helpful IMO. I'll mark this as the answer even though I dislike the answer

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-05-07T20:48:50.2+00:00

I completely understand your concern, your feedback here is valid from an admin and security perspective. You're absolutely right that seeing users who have left the company still listed can be misleading. It can give the impression they still have access and it doesn’t provide a clear “current state” view. What you're seeing is a known design behavior in Azure Managed Grafana. The User's page is not a real-time representation of active access. and It effectively shows a historical list of users who have logged into the workspace.
Mike Rees 40 Reputation points Microsoft Employee

2026-05-13T14:52:48.6166667+00:00

@Bharath Y P , this morning I logged in to add someone to a Team in Azure Managed Grafana, and when typing in the name, a user came up that is no longer with our organization, and does not have access when checking in the portal. This is a security risk isn't it? Obviously the onus is on me to select the correct user, but the only reason this user is showing up in the list is because at one time, he had access.
This is incredible to me that there is no syncing with Entra ID, and that once a user has access revoked, the user is still in the system, so to speak.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-05-15T01:12:18.99+00:00

Azure Managed Grafana uses Microsoft Entra ID (AAD) for authentication, a user whose account is disabled or removed from Entra ID genuinely cannot log in, regardless of what Grafana's internal database shows. So they can't actively use Grafana.Once a user is removed from IAM, Azure no longer sees them as having access. However, Grafana still sees them as a user because they logged in previously and were assigned a role. Grafana maintains its own internal user database, and users and their assigned roles are only listed in the Grafana UI once they've signed into the workspace but critically, they aren't automatically removed when IAM access is revoked.