> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Grafana connector

> C1 provides identity governance and just-in-time provisioning for Grafana. Integrate your Grafana instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

## Capabilities

| Resource      | Sync                                                          | Provision                                                     |
| :------------ | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

The Grafana connector supports both **self-hosted Grafana** instances and **Grafana Cloud**. The required credentials and provisioning behavior differ between the two — see [Gather Grafana credentials](#gather-grafana-credentials) below.

The Grafana connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).

For self-hosted Grafana, when a new account is created by C1, the account's password is sent to a [vault](/product/admin/vaults).
For Grafana Cloud, account creation is invite-based and no connector-generated password is returned.

<Note>
  **Grafana Cloud: provisioning organization roles for externally synced users**

  In Grafana Cloud, users who sign in through an external identity provider (such as Grafana.com SSO, Okta, Azure AD, or any OAuth/SAML provider) have their organization roles controlled by that provider. By default, Grafana blocks API-level role changes for these users, which prevents C1 from provisioning organization entitlements for them.

  To allow C1 to manage organization roles for these users, enable **Skip org role sync** for the relevant SSO provider in your Grafana instance:

  1. In Grafana, go to **Administration** → **Authentication**.
  2. Select the SSO provider your users log in with.
  3. Enable **Skip org role sync** (equivalent to setting `skip_org_role_sync = true`).

  Once this is enabled, Grafana stops overriding org roles on login and C1 becomes the authoritative source for role assignments. This is a global setting that applies to all users under that provider.

  This step is not required for self-hosted Grafana instances using basic (username/password) authentication.
</Note>

## Gather Grafana credentials

Configuring the connector requires credentials obtained in your Grafana instance. The credentials you need depend on whether you are connecting to **Grafana Cloud** or a **self-hosted Grafana** instance.

<Tabs>
  <Tab title="Grafana Cloud">
    For Grafana Cloud, the connector authenticates using a **service account token**. Basic username/password authentication is not supported in Cloud mode.

    To create a service account token:

    1. In your Grafana Cloud instance, go to **Administration** → **Users and access** → **Service accounts**.
    2. Click **Add service account**, give it a name, and assign it the **Admin** role.
    3. Open the new service account and click **Add service account token**.
    4. Copy and save the generated token — it will not be shown again.

    You will need:

    * Your Grafana Cloud instance URL (e.g., `https://your-org.grafana.net`)
    * The service account token generated above

    **Done.** Next, move on to the connector configuration instructions.
  </Tab>

  <Tab title="Self-hosted Grafana">
    For self-hosted Grafana, the connector authenticates using the username and password of a Grafana admin account.

    You will need:

    * The username and password for a Grafana account with **admin-level permissions**
    * Your Grafana instance URL

    **Done.** Next, move on to the connector configuration instructions.
  </Tab>
</Tabs>

## Configure the Grafana connector

<Warning>
  To complete this task, you'll need:

  * The **Connector Administrator** or **Super Administrator** role in C1
  * Access to the set of Grafana credentials gathered by following the instructions above
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    **Follow these instructions to use a built-in, no-code connector hosted by C1.**

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Grafana** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Grafana connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Paste your Grafana instance URL into the **Instance URL** field.
      </Step>

      <Step>
        Enter your credentials based on your Grafana deployment type:

        * **Grafana Cloud**: Select "API Key" as the auth method and paste your service account token into the **API Token** field.

        * **Self-hosted Grafana**: Select "Basic Authentication" as the auth method and paste the admin account's username and password into the **Username** and **Password** fields.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Grafana connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    **Follow these instructions to use the Grafana connector, hosted and run in your own environment.**

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

    ### Resources

    * [GitHub repository](https://github.com/conductorone/baton-grafana): Access the source code, report issues, or contribute to the project.

    ### Step 1: Set up a new Grafana connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Grafana connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. We'll use them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Grafana connector deployment. Use the secrets configuration that matches your Grafana deployment type.

    #### Secrets configuration — Grafana Cloud

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-grafana-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-grafana-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Grafana Cloud credentials
      BATON_HOSTNAME: <Grafana Cloud instance URL>       # e.g. https://your-org.grafana.net
      BATON_API_TOKEN: <service account token>

      # Optional: Include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true
    ```

    #### Secrets configuration — Self-hosted Grafana

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-grafana-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-grafana-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Self-hosted Grafana credentials
      BATON_HOSTNAME: <Grafana instance URL>
      BATON_USERNAME: <Grafana account username>
      BATON_PASSWORD: <Grafana account password>

      # Optional: Include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-grafana.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-grafana
      labels:
        app: baton-grafana
    spec:
      selector:
        matchLabels:
          app: baton-grafana
      template:
        metadata:
          labels:
            app: baton-grafana
            baton: true
            baton-app: grafana
        spec:
          containers:
          - name: baton-grafana
            image: ghcr.io/conductorone/baton-grafana:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-grafana
            envFrom:
            - secretRef:
                name: baton-grafana-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Grafana connector to. Grafana data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Grafana connector is now pulling access data into C1.
  </Tab>
</Tabs>