# Grafana + Lutril: setup guide

> Lutril governs Grafana in one of two provisioning modes, and you choose it when you connect. In JIT mode your SSO creates the account at first sign-in and Lutril manages the organization role, the team memberships and the account state. In SCIM mode Lutril provisions the user through Grafana's SCIM API, which needs Grafana Enterprise or Grafana Cloud. No password is ever generated: a SCIM user is created federated with no password at all, and in JIT mode Grafana's admin create endpoint requires one, so Lutril waits for the first SSO sign-in instead of creating an account. Either way a leaver is disabled rather than deleted, so dashboards, permissions and ownership survive and the same account can be switched back on for a returning employee.

Source: https://www.lutril.com/integrations/grafana
Category: Monitoring
Auth: service_account
Last verified: 2026-08-10

---

## Setup

1. Decide the provisioning mode. Choose jit if your users reach Grafana through SAML, OIDC or OAuth and Grafana creates their account on first sign-in. Choose scim if you run Grafana Enterprise or Grafana Cloud and want Grafana provisioned from your identity provider. Lutril never falls back from scim to jit: if SCIM turns out to be unavailable the connection is refused, so nothing silently changes which system owns the lifecycle.
2. For a service account token, go to Administration, then Users and access, then Service accounts. Click Add service account, give it a role covering the permissions listed above, then Add service account token and copy the token straight away.
3. For basic authentication on a self-hosted Grafana in jit mode, use a Grafana user holding the server administrator role. This is normally required, because the disable, enable and logout endpoints sit under global user administration.
4. In Lutril, connect Grafana and paste your Grafana URL, for example https://grafana.example.com or https://mystack.grafana.net. It must be https.
5. Set Provisioning Mode to jit or scim. In scim mode also set the SCIM Namespace: default for self-hosted Grafana, or stacks-{stackId} for Grafana Cloud.
6. Optionally set the Organization ID, for example 1. With it Lutril addresses that organization explicitly; without it Lutril acts on whichever organization the credential is signed into, which is ambiguous if you run more than one.
7. If Grafana already syncs team membership from your identity provider through Team Sync or SCIM group sync, set Team Membership Owner to team_sync or scim_groups. Lutril then refuses to write team rows that the next sign-in would revert, rather than reporting a change that did not stick. Grafana itself does not allow SCIM group sync and Team Sync at the same time.
8. Name your access levels after Grafana's own organization roles, Viewer, Editor and Admin, and the mapping needs no further configuration. A request with no level sends no role at all and Grafana applies its own auto_assign_org_role, so nobody is granted a role they did not ask for. Note that in scim mode Grafana's SCIM user provisioning does not set roles: those come from Role Sync at sign-in, so configure Role Sync if you want SCIM to drive them.
9. Save. Lutril runs a capability check that discovers your Grafana version, confirms the credential, verifies the organization exists and tests whether soft disable is genuinely available. A jit connection that cannot disable accounts is refused rather than accepted with a revocation it could not perform.

## Access requested

- JIT mode, self-hosted: basic authentication as a Grafana server administrator. Grafana's global user administration (disable, enable, revoke sessions) is only available to a server administrator, and an organization-scoped service account cannot be one.
- JIT mode, Grafana Cloud or Enterprise with RBAC: a service account token whose role grants users:read, users:disable, users:enable, users:logout, org.users:write and teams.permissions:write.
- SCIM mode: a service account token with the User administration role, plus the Teams role if you enable SCIM group sync.
- Never requested and never used by a lifecycle workflow: users:delete. Permanent deletion is a separate, opt-in operation that no expiry or offboarding can reach.

## References

- [Grafana documentation](https://grafana.com/docs/grafana/latest/developers/http_api/admin/)
- [Grafana console](https://grafana.com/docs/grafana/latest/administration/service-accounts/)
- [Service accounts and tokens](https://grafana.com/docs/grafana/latest/administration/service-accounts/)
- [User HTTP API (lookup, teams, orgs)](https://grafana.com/docs/grafana/latest/developers/http_api/user/)
- [SCIM provisioning (Enterprise and Cloud)](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-scim-provisioning/)
- [Organization roles and permissions](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/)